@fuzdev/fuz_app 0.134.0 → 0.136.0

package/dist/testing/cross_backend/body_size.js

@@ -5,11 +5,12 @@ import '../assert_dev_env.js';
  * `create_app_server` (TS) and the Rust spine both cap the request body at a
  * 1 MiB default (`DEFAULT_MAX_BODY_SIZE` / `fuz_http`'s
  * `DEFAULT_BODY_LIMIT_BYTES`) and reject oversized payloads with `413` and the
- * canonical flat REST body `{error: 'payload_too_large'}` — *before* auth,
+ * canonical flat REST body `{error: 'payload_too_large'}`. A declared
+ * `Content-Length` over the cap is refused on the header, *before* auth,
  * origin, or dispatch run (middleware step 4). Each impl unit-tests this in
- * isolation, but nothing fires an oversized POST over the wire, so the
- * cross-impl agreement on the status + body shape (and on the exact `>` cap
- * boundary, not an off-by-one divergence) was unpinned. Three cases:
+ * isolation; this suite pins the cross-impl agreement on the status + body
+ * shape, on the exact `>` cap boundary (not an off-by-one divergence), and on
+ * the cap answering ahead of the origin check and of auth. The cases:
  *
  * - **over-limit POST (cap + 1 byte) → 413** `payload_too_large`, refused
  *   before any handler runs (the limit fires ahead of origin verification + the
@@ -24,17 +25,48 @@ import '../assert_dev_env.js';
  * - **under-limit POST (small) → 200** — a small, well-formed authenticated
  *   `account_verify` envelope sails through to a successful handler response,
  *   the positive control that the route works for normal traffic.
+ * - **over-limit POST with a disallowed `Origin` → 413**, not the origin
+ *   check's 403, and **over-limit POST with no credentials → 413**, not 401:
+ *   the cap answers a declared length ahead of both. The control — the same
+ *   disallowed `Origin` on an under-limit body → 403 `forbidden_origin` —
+ *   shows the origin check still runs.
+ * - **over-limit chunked POST (no `Content-Length`), authenticated → 413** —
+ *   a body with no declared length is refused by the bytes that arrive.
  *
- * **Real-socket connection hazard (cross-process only).** When the server caps
- * the body it answers 413 and closes the connection *before* the client
- * finishes uploading — correct HTTP, since an unread request body can't share a
- * keep-alive socket. The client's pool can then hand that now-dead socket to
- * the very next request (observed as `other side closed`). So every request
- * here goes through `fetch_retrying_once`: a request that inherits the poisoned
- * socket retries onto a fresh connection, which both keeps the suite
- * deterministic *and* evicts the dead socket so it can't strand a later cross
- * suite in the same process. In-process (`app.request`) has no socket, so the
- * hazard is cross-process-only and the retry never fires there.
+ * **Implementation-defined, not pinned here.** Without a declared length the
+ * two spines measure at different points: the TS spine reads the body up to
+ * the cap before any later middleware runs, so its 413 comes ahead of the
+ * origin check and auth; the Rust spine counts as the handler reads, so a
+ * refusal made on the headers (a disallowed `Origin`) answers first and a
+ * handler that never reads the body answers its own status. Only the
+ * authenticated, allowed-origin chunked case — where nothing else refuses —
+ * has one answer on every backend. A repeated `Content-Length` with equal
+ * values is also the implementation's: the TS spine answers 400
+ * `invalid_content_length` where its runtime's parser hands the repeat over,
+ * and hyper folds it into one value and accepts.
+ *
+ * **Over a real socket the over-cap cases send no byte the server won't
+ * read.** A server that caps the body answers 413 and may close the
+ * connection with the rest of the upload unread — correct HTTP, since an
+ * unread request body can't share a keep-alive socket. A client still
+ * uploading then has its write fail (`EPIPE`) and can lose the 413 the server
+ * did send, so a whole over-cap body sent through `fetch` reads its answer
+ * only some of the time. Given a `base_url`, the suite speaks to the socket
+ * directly (`raw_http_exchange`) and holds back what the refusal doesn't need:
+ *
+ * - a **declared** over-cap length is sent as the request head alone —
+ *   `Content-Length` one over the cap and not one body byte. The 413 must
+ *   arrive within `RAW_READ_TIMEOUT_MS`, which also pins that the refusal is
+ *   made on the header: a backend that reads the body before refusing, or has
+ *   no cap, waits for bytes that never come and fails the case.
+ * - the **chunked** body is sent up to one byte past the cap and never
+ *   terminated. The server has read every byte sent by the time it has counted
+ *   past the cap, so nothing is left unread, and the 413 must arrive without
+ *   the body's end.
+ *
+ * With `base_url: null` there is no socket and no such race (the in-process
+ * `app.request`), so the same cases send whole bodies through the fixture's
+ * transport. The under-cap cases go through the transport either way.
  *
  * Like origin/payload rejection, this is middleware-level flat REST — not the
  * JSON-RPC envelope the conformance-table runner expects — so it's an
@@ -51,7 +83,8 @@ import '../assert_dev_env.js';
  */
 import { describe, test, assert } from 'vitest';
 import { account_verify_action_spec } from '../../auth/account_action_specs.js';
-import { ERROR_PAYLOAD_TOO_LARGE } from '../../http/error_schemas.js';
+import { ERROR_FORBIDDEN_ORIGIN, ERROR_PAYLOAD_TOO_LARGE } from '../../http/error_schemas.js';
+import { raw_http_exchange, raw_http_parse_response } from '../transports/raw_http.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /**
  * The shared 1 MiB default both impls ship (`DEFAULT_MAX_BODY_SIZE` in TS,
@@ -78,41 +111,159 @@ const sized_envelope = (id, target_bytes) => {
 };
 /** A small, well-formed nullary `account_verify` body — well under the cap. */
 const small_envelope = (id) => JSON.stringify({ jsonrpc: '2.0', method: account_verify_action_spec.method, id });
+/** An `Origin` no backend's allowlist admits. */
+const DISALLOWED_ORIGIN = 'http://evil.com';
+/** Chunk size of the streamed over-cap body. */
+const STREAM_CHUNK_BYTES = 64 * 1024;
+/**
+ * A request body of `total_bytes` delivered as a stream, so the request
+ * carries no `Content-Length` (`Transfer-Encoding: chunked` over a socket).
+ * Single-use.
+ */
+const streamed_body = (total_bytes) => {
+    let sent = 0;
+    return new ReadableStream({
+        pull: (controller) => {
+            if (sent >= total_bytes) {
+                controller.close();
+                return;
+            }
+            const size = Math.min(STREAM_CHUNK_BYTES, total_bytes - sent);
+            sent += size;
+            controller.enqueue(new Uint8Array(size).fill(0x78));
+        }
+    });
+};
 /**
- * Issue a request, retrying once if the call *throws* (vs. returning a
- * response). A request handed the keep-alive socket the server closed on an
- * oversized-body rejection fails at the transport layer before any response;
- * one retry opens a fresh connection (and drops the dead socket from the
- * pool). Keyed on "threw at all" rather than a specific error code so it holds
- * across the node / deno / bun cross runtimes, which surface different errors.
+ * How long a raw over-cap exchange waits for the refusal. The server has every
+ * byte it will get when the wait starts, so a backend that refuses on what it
+ * has answers at once and one that waits for more runs the whole window.
  */
-const fetch_retrying_once = async (transport, path, init) => {
+const RAW_READ_TIMEOUT_MS = 2000;
+const to_sized_response = async (res) => ({
+    status: res.status,
+    body: await res.json().catch(() => undefined)
+});
+const parse_json = (text) => {
     try {
-        return await transport(path, init);
+        return JSON.parse(text);
     }
     catch {
-        return await transport(path, init);
+        return undefined;
     }
 };
+/** Render request headers as raw header lines. */
+const to_header_lines = (headers) => Object.entries(headers)
+    .map(([name, value]) => `${name}: ${value}\r\n`)
+    .join('');
+/**
+ * Write `request_bytes` to the backend's socket and read the one response it
+ * must answer with — without being sent anything more.
+ *
+ * @param withheld - what the request leaves unsent, for the failure message
+ */
+const exchange_withholding = async (base_url, request_bytes, withheld) => {
+    const { received, closed_by_server } = await raw_http_exchange(base_url, request_bytes, {
+        read_timeout_ms: RAW_READ_TIMEOUT_MS,
+        until: 'response'
+    });
+    const response = raw_http_parse_response(received);
+    assert.ok(response, `expected a whole response with ${withheld} withheld; ` +
+        (closed_by_server
+            ? `the server closed the connection first`
+            : `none arrived within ${RAW_READ_TIMEOUT_MS}ms — the backend is waiting for bytes ` +
+                `it should refuse without`) +
+        `. Received: ${received ? received.slice(0, 120) : 'nothing'}`);
+    return { status: response.status, body: parse_json(response.body) };
+};
+/** Assert a response is the canonical over-cap refusal. */
+const assert_payload_too_large = (res, message) => {
+    assert.strictEqual(res.status, 413, message);
+    assert.strictEqual(res.body?.error, ERROR_PAYLOAD_TOO_LARGE);
+};
 export const describe_body_size_cross_tests = (options) => {
-    const { setup_test } = options;
+    const { setup_test, base_url } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
-    /** POST `body` to the RPC path as the keeper, retry-once on a dead socket. */
-    const post = (fixture, body) => fetch_retrying_once(fixture.transport, rpc_path, {
+    /** POST `body` to the RPC path as the keeper. */
+    const post = (fixture, body) => fixture.transport(rpc_path, {
         method: 'POST',
         headers: { ...fixture.create_session_headers(), 'content-type': 'application/json' },
         body
     });
+    /**
+     * POST with a declared `Content-Length` one byte over the cap. Over a
+     * socket only the head is sent; in-process, the whole body.
+     *
+     * `headers` carries the credential and any `Origin`, which defaults to the
+     * backend's own. `anonymous` picks the cookie-jar-free transport in-process;
+     * a raw head carries only what `headers` names either way.
+     */
+    const post_over_limit_declared = async (fixture, request) => {
+        const { id, headers, anonymous } = request;
+        const content_length = BODY_LIMIT_DEFAULT_BYTES + 1;
+        if (base_url === null) {
+            const transport = anonymous ? fixture.fresh_transport() : fixture.transport;
+            return to_sized_response(await transport(rpc_path, {
+                method: 'POST',
+                headers: { ...headers, 'content-type': 'application/json' },
+                body: sized_envelope(id, content_length)
+            }));
+        }
+        const url = new URL(base_url);
+        return exchange_withholding(base_url, `POST ${rpc_path} HTTP/1.1\r\n` +
+            to_header_lines({
+                host: url.host,
+                origin: url.origin,
+                ...headers,
+                'content-type': 'application/json',
+                'content-length': String(content_length)
+            }) +
+            `\r\n`, 'the declared body');
+    };
+    /**
+     * POST a chunked body past the cap as the keeper. Over a socket the body
+     * stops one byte past the cap, unterminated; in-process, a whole streamed
+     * body runs past it.
+     */
+    const post_over_limit_chunked = async (fixture) => {
+        if (base_url === null) {
+            return to_sized_response(await fixture.transport(rpc_path, {
+                method: 'POST',
+                headers: { ...fixture.create_session_headers(), 'content-type': 'application/json' },
+                body: streamed_body(BODY_LIMIT_DEFAULT_BYTES + 1024),
+                // a streamed request body needs half-duplex `fetch`
+                duplex: 'half'
+            }));
+        }
+        const url = new URL(base_url);
+        // whole chunks up to exactly the cap, then a one-byte chunk's size line
+        // and its byte — and neither that chunk's closing CRLF nor the
+        // terminating chunk, so the last byte sent is the first one past the cap
+        const whole_chunk = `${STREAM_CHUNK_BYTES.toString(16)}\r\n${'x'.repeat(STREAM_CHUNK_BYTES)}\r\n`;
+        return exchange_withholding(base_url, `POST ${rpc_path} HTTP/1.1\r\n` +
+            to_header_lines({
+                host: url.host,
+                origin: url.origin,
+                ...fixture.create_session_headers(),
+                'content-type': 'application/json',
+                'transfer-encoding': 'chunked'
+            }) +
+            `\r\n` +
+            whole_chunk.repeat(BODY_LIMIT_DEFAULT_BYTES / STREAM_CHUNK_BYTES) +
+            `1\r\nx`, `the chunked body's end`);
+    };
     describe('body-size limit parity', () => {
         test('over-limit POST (cap + 1) → 413 payload_too_large (refused before dispatch)', async () => {
             const fixture = await setup_test();
-            // Keeper session cookie + the transport's default allowed Origin, so
-            // neither auth nor origin is the cause — only the body size. One byte
-            // over the cap: both impls reject on a strict `>`.
-            const res = await post(fixture, sized_envelope('over-limit', BODY_LIMIT_DEFAULT_BYTES + 1));
-            assert.strictEqual(res.status, 413, 'a body one byte over the cap must be rejected with 413');
-            const body = (await res.json().catch(() => undefined));
-            assert.strictEqual(body?.error, ERROR_PAYLOAD_TOO_LARGE);
+            // Keeper session cookie + the default allowed Origin, so neither auth
+            // nor origin is the cause — only the size. One byte over the cap: both
+            // impls reject on a strict `>`.
+            const res = await post_over_limit_declared(fixture, {
+                id: 'over-limit',
+                headers: fixture.create_session_headers(),
+                anonymous: false
+            });
+            assert_payload_too_large(res, 'a body one byte over the cap must be rejected with 413');
         });
         test('at-limit POST (exactly the cap) → not size-rejected', async () => {
             const fixture = await setup_test();
@@ -130,5 +281,53 @@ export const describe_body_size_cross_tests = (options) => {
             const res = await post(fixture, small_envelope('under-limit'));
             assert.strictEqual(res.status, 200, 'an under-limit authenticated request must pass');
         });
+        test('over-limit POST with a disallowed Origin → 413, not 403', async () => {
+            const fixture = await setup_test();
+            // Keeper session + a rogue Origin: the origin check would answer 403,
+            // and the cap, which reads only the declared length, answers first.
+            const res = await post_over_limit_declared(fixture, {
+                id: 'over-limit-evil-origin',
+                headers: { ...fixture.create_session_headers(), origin: DISALLOWED_ORIGIN },
+                anonymous: false
+            });
+            assert_payload_too_large(res, 'a declared length over the cap must answer 413 ahead of the origin check');
+        });
+        test('under-limit POST with a disallowed Origin → 403 forbidden_origin', async () => {
+            const fixture = await setup_test();
+            // The control for the case above: the same request minus the size is
+            // refused by the origin check, so the 413 there is the cap answering
+            // first, not the origin check being absent.
+            const res = await fixture.transport(rpc_path, {
+                method: 'POST',
+                headers: {
+                    ...fixture.create_session_headers(),
+                    origin: DISALLOWED_ORIGIN,
+                    'content-type': 'application/json'
+                },
+                body: small_envelope('under-limit-evil-origin')
+            });
+            assert.strictEqual(res.status, 403, 'a disallowed Origin on an under-limit body is refused');
+            const body = (await res.json().catch(() => undefined));
+            assert.strictEqual(body?.error, ERROR_FORBIDDEN_ORIGIN);
+        });
+        test('over-limit POST with no credentials → 413, not 401', async () => {
+            const fixture = await setup_test();
+            // No cookie, no token: the dispatcher would answer 401, and the cap
+            // answers first.
+            const res = await post_over_limit_declared(fixture, {
+                id: 'over-limit-anonymous',
+                headers: {},
+                anonymous: true
+            });
+            assert_payload_too_large(res, 'a declared length over the cap must answer 413 ahead of auth');
+        });
+        test('over-limit chunked POST (no Content-Length), authenticated → 413', async () => {
+            const fixture = await setup_test();
+            // Keeper session + the default allowed Origin, so nothing but the size
+            // refuses. No declared length for the header check to read, so the
+            // refusal is by the bytes that arrive.
+            const res = await post_over_limit_chunked(fixture);
+            assert_payload_too_large(res, 'a chunked body past the cap must be rejected with 413 when nothing else refuses');
+        });
     });
 };

package/dist/testing/cross_backend/body_size_smuggling.d.ts

@@ -5,18 +5,6 @@ export interface BodySizeSmugglingCrossTestOptions {
     readonly base_url: string;
     /** RPC endpoint path to target. Default `/api/rpc`. */
     readonly rpc_path?: string;
-    /**
-     * Whether the backend closes the connection on an oversized-body reject
-     * without reading the body (`capabilities.oversized_reject_closes_connection`).
-     * `true` (default) demands the strong posture — the pipelined GET is never
-     * reached, so **at most one** response comes back. `false` (Bun) relaxes to
-     * the no-desync property: the body is drained on `Content-Length` and the
-     * pipelined GET is framed correctly, so **at most two** responses come back
-     * and the body bytes are never reparsed as a request. Default `true` so a
-     * consumer that forgets to declare the flag fails loud rather than silently
-     * accepting a drain.
-     */
-    readonly closes_connection?: boolean;
 }
 export declare const describe_body_size_smuggling_cross_tests: (options: BodySizeSmugglingCrossTestOptions) => void;
 //# sourceMappingURL=body_size_smuggling.d.ts.map

package/dist/testing/cross_backend/body_size_smuggling.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body_size_smuggling.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size_smuggling.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwD9B,4EAA4E;AAC5E,MAAM,WAAW,iCAAiC;IACjD,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACrC;AAqDD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IAiFF,CAAC"}
+{"version":3,"file":"body_size_smuggling.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/body_size_smuggling.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAmE9B,4EAA4E;AAC5E,MAAM,WAAW,iCAAiC;IACjD,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAWD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IA4GF,CAAC"}

package/dist/testing/cross_backend/body_size_smuggling.js

@@ -10,154 +10,149 @@ import '../assert_dev_env.js';
  * body bytes would be parsed as the start of the next request — a classic
  * request-smuggling vector. This suite probes the boundary by **pipelining**:
  * it opens a raw TCP socket and sends, in one write, an oversized `POST`
- * immediately followed by a second `GET`. The assertion forks on the backend's
- * declared `oversized_reject_closes_connection` capability:
+ * immediately followed by a second `GET`. Every backend must close after the
+ * reject, so the pipelined GET goes unanswered and **at most one** response
+ * comes back. `<= 1` rather than "exactly the 413" because the impls close
+ * differently at the TCP level (a graceful close delivers the 413 first;
+ * hyper's RST can drop the in-flight 413 before the client reads it), so
+ * demanding a cleanly-read 413 would be flaky.
  *
- * - **Closes (Node / Deno / hyper)** — the reject closes the socket with the
- *   GET bytes unconsumed, so **at most one** response comes back. `<= 1` rather
- *   than "exactly the 413" because the impls close differently at the TCP level
- *   (node-server graceful close delivers the 413 first; hyper's RST can drop the
- *   in-flight 413 before the client reads it), so demanding a cleanly-read 413
- *   would be flaky.
- * - **Drains + keepalives (Bun)** — `Bun.serve` reads the full declared
- *   `Content-Length` body and answers the *correctly-framed* pipelined GET, so
- *   **two** responses come back. This is **not** a smuggle: the GET is delimited
- *   by the body's `Content-Length`, not the unread body reinterpreted as a
- *   request — Bun answers it with a clean `400` (`missing method`), not the `x`
- *   body bytes reparsed. The security property asserted here is **no desync**
- *   (`<= 2`): a real desync would reframe the 1 MiB of `x` into bogus request
- *   lines and push the count past two.
+ * - **Node** closes at once with the body unread — `create_app_server`'s body
+ *   limit (`http/body_limit.ts`) refuses on the header and answers
+ *   `Connection: close`, which is what makes `@hono/node-server` close.
+ * - **Bun** closes at once too, honouring that header. Bun 1.4.3 is the tested
+ *   floor: an older Bun kept the connection after the 413 and served the next
+ *   request (correctly framed), which fails this suite.
+ * - **Deno** closes once the whole declared body has arrived, which this
+ *   probe's single write delivers; a client that withholds the body holds a
+ *   Deno connection open, and no request behind the body is served either way.
+ * - **hyper** (the Rust spine) closes at once.
  *
- * Either way the oversized body is rejected *with* a 413 — pinned reliably over
- * `fetch` by `describe_body_size_cross_tests`; this test owns only the
- * connection-handling half. A **positive control** (two pipelined requests →
- * `>= 2` responses) proves a second response *would* be seen if a trailing
- * request were processed — without it the close-posture `<= 1` would be vacuous
- * on a server that never reuses connections — and that the counter isn't
+ * The oversized body is rejected *with* a 413 on every backend — pinned
+ * reliably by `describe_body_size_cross_tests`, which sends the over-cap
+ * request's head and no body, so no upload races the close; this test owns
+ * only the connection-handling half. A **positive control** (two pipelined
+ * requests → `>= 2` responses) proves a second response *would* be seen if a
+ * trailing request were processed — without it `<= 1` would be vacuous on a
+ * server that never reuses connections — and that the counter isn't
  * undercounting.
  *
+ * **`Content-Length` beside `Transfer-Encoding`.** The second probe sends a
+ * request carrying both headers — the shape a request-smuggling attack hands a
+ * server and a proxy that disagree on which one frames the body — with a
+ * `GET` pipelined behind it. What the backends share is the outcome, not the
+ * status: the request is refused with `400` (the Node, Deno and Bun parsers)
+ * or answered as its chunked body reads (hyper, which drops the
+ * `Content-Length`), and either way the server **closes the connection** and
+ * the pipelined request is **never served**. The status of the one response
+ * is implementation-defined and not asserted.
+ *
  * Raw-socket by necessity (the `FetchTransport` can't pipeline two requests on
  * one connection), so — unlike `body_size.ts` — this is **cross-process only**
- * (no in-process leg; there is no socket in-process). The connection-close half
- * is capability-gated; the no-desync half holds on every spine.
+ * (no in-process leg; there is no socket in-process — the in-process pin is
+ * that the reject never reads the request body, in
+ * `server/create_app_server.db.test.ts`).
  *
  * Cited property: `docs/security.md` §"Body Size Limiting" (connection handling
  * on oversized reject).
  *
  * @module
  */
-import { connect } from 'node:net';
 import { describe, test, assert } from 'vitest';
+import { raw_http_count_responses, raw_http_exchange } from '../transports/raw_http.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** The shared 1 MiB cap (see `body_size.ts` for why it's a local constant). */
 const BODY_LIMIT_DEFAULT_BYTES = 1024 * 1024;
 /**
- * Open a raw TCP socket to `base_url`, write `request_bytes` once, and collect
- * everything the server sends back until it closes the connection or
- * `read_timeout_ms` elapses. Write errors are swallowed: the server closing
- * mid-upload (the correct response to an oversized body) surfaces as
- * `EPIPE`/`ECONNRESET` on our unfinished write, which is exactly the behavior
- * under test — what matters is what we *read back*.
- */
-const send_raw = (base_url, request_bytes, read_timeout_ms) => new Promise((resolve) => {
-    const url = new URL(base_url);
-    const port = Number(url.port) || (url.protocol === 'https:' ? 443 : 80);
-    const socket = connect({ host: url.hostname, port });
-    let received = '';
-    let settled = false;
-    const finish = () => {
-        if (settled)
-            return;
-        settled = true;
-        clearTimeout(timer);
-        socket.destroy();
-        resolve(received);
-    };
-    const timer = setTimeout(finish, read_timeout_ms);
-    socket.setEncoding('latin1');
-    socket.on('connect', () => socket.write(request_bytes));
-    socket.on('data', (chunk) => {
-        received += chunk;
-    });
-    socket.on('error', () => { }); // EPIPE/ECONNRESET on mid-write close is expected
-    socket.on('close', finish);
-});
-/**
- * Count HTTP response status lines in a raw byte stream. Deliberately
- * **unanchored** (no `^`/`m`): a second pipelined response is concatenated
- * straight after the first response's body, which carries no trailing newline,
- * so a line-anchored match would miss it — and missing a smuggled second
- * response is a silent false negative. No response header or JSON error body
- * contains the literal `HTTP/1.x NNN`, so an unanchored match counts exactly
- * the status lines. The positive control below proves this counts 2 when the
- * server genuinely returns 2.
+ * How long each raw exchange waits for the server to finish answering. An
+ * exchange the backend does not end by closing runs the whole window.
  */
-const count_responses = (raw) => (raw.match(/HTTP\/1\.[01] \d{3}/g) ?? []).length;
+const RAW_READ_TIMEOUT_MS = 2000;
 export const describe_body_size_smuggling_cross_tests = (options) => {
     const { base_url } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
-    const closes_connection = options.closes_connection ?? true;
     const host = new URL(base_url).host;
     describe('body-size limit — request-smuggling resistance', () => {
         // Positive control: prove the server returns >1 response on a single
         // connection. Without this the smuggling assertion below would be
         // vacuously green on a server that simply never reuses connections — and
-        // it also validates `count_responses` actually counts a second response.
+        // it also validates `raw_http_count_responses` actually counts a second response.
         test('control: two pipelined requests → ≥2 responses (connection reuse is real)', async () => {
             const two_requests = `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\n\r\n` +
                 `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\nConnection: close\r\n\r\n`;
-            const response = await send_raw(base_url, two_requests, 2000);
-            const n = count_responses(response);
+            const { received: response } = await raw_http_exchange(base_url, two_requests, {
+                read_timeout_ms: RAW_READ_TIMEOUT_MS
+            });
+            const n = raw_http_count_responses(response);
             assert.ok(n >= 2, `expected ≥2 responses on one keep-alive connection (got ${n}); without ` +
                 `connection reuse — or with an undercounting matcher — the smuggling ` +
                 `assertion below is not a real signal. Raw head: ${response.slice(0, 120)}`);
         });
-        test('oversized POST + pipelined GET → smuggled request not processed', async () => {
+        test('oversized POST + pipelined GET → no request smuggled', async () => {
             const oversized_len = BODY_LIMIT_DEFAULT_BYTES + 1024;
-            // One write: an over-cap POST (rejected on Content-Length, body never
-            // read) immediately followed by a GET. If the server wrongly drained
-            // the unread body it would reach + answer this GET — a smuggle.
+            const pipelined_get = `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\n\r\n`;
+            // One write: an over-cap POST (rejected on Content-Length) immediately
+            // followed by a GET.
             const payload = `POST ${rpc_path} HTTP/1.1\r\n` +
                 `Host: ${host}\r\n` +
                 `Content-Type: application/json\r\n` +
                 `Content-Length: ${oversized_len}\r\n` +
                 `\r\n` +
                 'x'.repeat(oversized_len) +
-                `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\n\r\n`;
-            const response = await send_raw(base_url, payload, 2000);
-            const n = count_responses(response);
-            if (closes_connection) {
-                // Strong posture (Node / Deno / hyper): the reject closes the
-                // connection *without reading the body*, so the pipelined GET is
-                // never reached — **at most one** response comes back (the 413, or
-                // none if the close raced the read). A *second* response would mean
-                // the body was drained and the GET processed. We assert `<= 1` rather
-                // than "exactly the 413" because the impls close differently at the
-                // TCP level — node-server closes gracefully (413 delivered first),
-                // hyper sends an RST that can drop the in-flight 413 before the client
-                // reads it — and demanding a cleanly-read 413 would be flaky. The
-                // 413-ness itself is pinned reliably (over `fetch`) by
-                // `describe_body_size_cross_tests`. The control above proves a second
-                // response *would* be seen if the GET were processed, so `<= 1` is a
-                // real signal, not vacuous.
-                assert.ok(n <= 1, `expected at most one response (oversized reject closes the connection; the ` +
-                    `pipelined GET must not be reached). Saw ${n}. Raw head: ${response.slice(0, 120)}`);
-            }
-            else {
-                // Drain-and-keepalive posture (Bun): `Bun.serve` reads the full
-                // declared `Content-Length` body and keeps the socket alive, so it
-                // answers the *correctly-framed* pipelined GET — **two** responses
-                // (the 413 + a well-formed reply to the GET). This is not a smuggle:
-                // the GET is delimited by the body's `Content-Length`, not the unread
-                // body reinterpreted as request bytes. The security property here is
-                // **no desync** — the body bytes are never reparsed as request(s). A
-                // real desync would reframe the 1 MiB of `x` into bogus request
-                // lines, pushing the count past two; `<= 2` is the no-desync bound,
-                // and the control above proves the counter isn't undercounting.
-                assert.ok(n <= 2, `expected at most two responses (the 413 + one framed reply to the ` +
-                    `pipelined GET); more means the oversized body was reparsed as requests ` +
-                    `(a desync). Saw ${n}. Raw head: ${response.slice(0, 120)}`);
-            }
+                pipelined_get;
+            const { received: response } = await raw_http_exchange(base_url, payload, {
+                read_timeout_ms: RAW_READ_TIMEOUT_MS
+            });
+            const n = raw_http_count_responses(response);
+            // The reject closes the connection, so the pipelined GET is never
+            // reached — **at most one** response comes back (the 413, or none if
+            // the close raced the read). A *second* response means the connection
+            // was kept and the GET served. The control above proves a second
+            // response *would* be seen, so `<= 1` is a real signal.
+            assert.ok(n <= 1, `expected at most one response (oversized reject closes the connection; the ` +
+                `pipelined GET must not be reached). Saw ${n}. Raw head: ${response.slice(0, 120)}`);
         });
+        // A request carrying both `Content-Length` and `Transfer-Encoding`, with
+        // a GET pipelined behind it. The body is a small JSON-RPC envelope,
+        // chunked and terminated, so a backend that frames on
+        // `Transfer-Encoding` reads a whole request. `Content-Length` disagrees
+        // with the chunked length in both cases: framing on it instead would
+        // leave body bytes to be parsed as the next request.
+        const envelope = JSON.stringify({ jsonrpc: '2.0', id: 'cl-te', method: 'heartbeat' });
+        const chunked_envelope = `${envelope.length.toString(16)}\r\n${envelope}\r\n0\r\n\r\n`;
+        const framing_cases = [
+            [
+                'Content-Length ahead of Transfer-Encoding',
+                `Content-Length: 5\r\nTransfer-Encoding: chunked\r\n`
+            ],
+            [
+                'Transfer-Encoding ahead of Content-Length',
+                `Transfer-Encoding: chunked\r\nContent-Length: 5\r\n`
+            ]
+        ];
+        for (const [name, framing_headers] of framing_cases) {
+            test(`${name} + pipelined GET → connection closed, GET never served`, async () => {
+                const payload = `POST ${rpc_path} HTTP/1.1\r\n` +
+                    `Host: ${host}\r\n` +
+                    `Content-Type: application/json\r\n` +
+                    framing_headers +
+                    `\r\n` +
+                    chunked_envelope +
+                    `GET ${rpc_path} HTTP/1.1\r\nHost: ${host}\r\n\r\n`;
+                const { received, closed_by_server } = await raw_http_exchange(base_url, payload, {
+                    read_timeout_ms: RAW_READ_TIMEOUT_MS
+                });
+                const n = raw_http_count_responses(received);
+                // Refused with 400 or answered — the status is the implementation's.
+                // A second response is the pipelined GET served on a connection the
+                // ambiguous request should have ended.
+                assert.ok(n <= 1, `expected at most one response to a request carrying both Content-Length ` +
+                    `and Transfer-Encoding (the pipelined GET must not be served). Saw ${n}. ` +
+                    `Raw head: ${received.slice(0, 120)}`);
+                assert.ok(closed_by_server, `expected the server to close the connection after a request carrying both ` +
+                    `Content-Length and Transfer-Encoding; it was still open after ` +
+                    `${RAW_READ_TIMEOUT_MS}ms. Raw head: ${received.slice(0, 120)}`);
+            });
+        }
     });
 };