appium-webdriveragent 16.9.2 → 16.9.3

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [16.9.3](https://github.com/appium/WebDriverAgent/compare/v16.9.2...v16.9.3) (2026-08-29)
+
+### Bug Fixes
+
+* reject malformed Content-Length values and bound request header buffering ([#1226](https://github.com/appium/WebDriverAgent/issues/1226)) ([60c5fc4](https://github.com/appium/WebDriverAgent/commit/60c5fc461d91611778b8bb0745a21c80451d6ccf))
+
 ## [16.9.2](https://github.com/appium/WebDriverAgent/compare/v16.9.1...v16.9.2) (2026-08-28)
 
 ### Bug Fixes

package/WebDriverAgent.xcodeproj/project.pbxproj

@@ -1190,6 +1190,7 @@
 		EE8DDD7F20C5733C004D4925 /* XCUIElement+FBForceTouch.h in Headers */ = {isa = PBXBuildFile; fileRef = EE8DDD7D20C5733C004D4925 /* XCUIElement+FBForceTouch.h */; settings = {ATTRIBUTES = (Public, ); }; };
 		EE9AB8011CAEE048008C271F /* UITestingUITests.m in Sources */ = {isa = PBXBuildFile; fileRef = EE9AB7FD1CAEE048008C271F /* UITestingUITests.m */; };
 		EE9B76591CF7987800275851 /* FBRouteTests.m in Sources */ = {isa = PBXBuildFile; fileRef = EE9B76571CF7987300275851 /* FBRouteTests.m */; };
+		DF82F4A8758B79DD91FA20CC /* FBHTTPServerTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 76B7399DDF52C85A21433C1D /* FBHTTPServerTests.m */; };
 		EE9B768E1CF7997600275851 /* AppDelegate.m in Sources */ = {isa = PBXBuildFile; fileRef = EE9B76831CF7997600275851 /* AppDelegate.m */; };
 		EE9B768F1CF7997600275851 /* ViewController.m in Sources */ = {isa = PBXBuildFile; fileRef = EE9B76851CF7997600275851 /* ViewController.m */; };
 		EE9B76911CF7997600275851 /* main.m in Sources */ = {isa = PBXBuildFile; fileRef = EE9B76871CF7997600275851 /* main.m */; };
@@ -1905,6 +1906,7 @@
 		EE9B75D41CF7956C00275851 /* IntegrationApp.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = IntegrationApp.app; sourceTree = BUILT_PRODUCTS_DIR; };
 		EE9B75EC1CF7956C00275851 /* IntegrationTests_1.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = IntegrationTests_1.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
 		EE9B76571CF7987300275851 /* FBRouteTests.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = FBRouteTests.m; sourceTree = "<group>"; };
+		76B7399DDF52C85A21433C1D /* FBHTTPServerTests.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = FBHTTPServerTests.m; sourceTree = "<group>"; };
 		EE9B76581CF7987300275851 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
 		EE9B76821CF7997600275851 /* AppDelegate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AppDelegate.h; sourceTree = "<group>"; };
 		EE9B76831CF7997600275851 /* AppDelegate.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = AppDelegate.m; sourceTree = "<group>"; };
@@ -2675,6 +2677,7 @@
 				713352FC26CEF31D00523CBC /* FBLRUCacheTests.m */,
 				EE18883C1DA663EB00307AA8 /* FBMathUtilsTests.m */,
 				718F49C7230844330045FE8B /* FBProtocolHelpersTests.m */,
+				76B7399DDF52C85A21433C1D /* FBHTTPServerTests.m */,
 				EE9B76571CF7987300275851 /* FBRouteTests.m */,
 				EE3F8CFD1D08AA17006F02CE /* FBRunLoopSpinnerTests.m */,
 				ADEF63AE1D09DEBE0070A7E3 /* FBRuntimeUtilsTests.m */,
@@ -4809,6 +4812,7 @@
 				719FF5B91DAD21F5008E0099 /* FBElementUtilitiesTests.m in Sources */,
 				716E0BD11E917F260087A825 /* FBXMLSafeStringTests.m in Sources */,
 				ADEF63AF1D09DEBE0070A7E3 /* FBRuntimeUtilsTests.m in Sources */,
+				DF82F4A8758B79DD91FA20CC /* FBHTTPServerTests.m in Sources */,
 				EE9B76591CF7987800275851 /* FBRouteTests.m in Sources */,
 				7139145C1DF01A12005896C2 /* NSExpressionFBFormatTests.m in Sources */,
 				71A224E81DE326C500844D55 /* NSPredicateFBFormatTests.m in Sources */,

package/WebDriverAgentLib/Info.plist

@@ -15,11 +15,11 @@
     <key>CFBundlePackageType</key>
     <string>FMWK</string>
     <key>CFBundleShortVersionString</key>
-    <string>16.9.2</string>
+    <string>16.9.3</string>
     <key>CFBundleSignature</key>
     <string>????</string>
     <key>CFBundleVersion</key>
-    <string>16.9.2</string>
+    <string>16.9.3</string>
     <key>NSPrincipalClass</key>
     <string/>
   </dict>

package/WebDriverAgentLib/Routing/FBHTTPServer.m

@@ -10,6 +10,7 @@
 
 #import "FBCommandStatus.h"
 #import "FBConfiguration.h"
+#import "FBLogger.h"
 #import "FBResponsePayload.h"
 #import "FBTCPSocket.h"
 
@@ -30,6 +31,35 @@ static NSData * _Nonnull FBUTF8Data(NSString *string)
   return (NSData * _Nonnull)[string dataUsingEncoding:NSUTF8StringEncoding];
 }
 
+// Caps a request's header block, so a connection that never completes one cannot grow its buffer
+// without limit. Matches node's default --max-http-header-size.
+static const NSUInteger FBMaxRequestHeaderSize = 16 * 1024;
+
+// ASCII decimal digits only. -integerValue must not be used here: it maps garbage silently
+// ("bogus" -> 0, "12abc" -> 12), desyncing the framing of every later request on the connection.
+static BOOL FBParseContentLength(NSString *value, NSUInteger *outLength)
+{
+  if (value.length < 1) {
+    return NO;
+  }
+  NSUInteger result = 0;
+  for (NSUInteger i = 0; i < value.length; i++) {
+    unichar c = [value characterAtIndex:i];
+    if (c < '0' || c > '9') {
+      return NO;
+    }
+    NSUInteger digit = (NSUInteger)(c - '0');
+    // NSUInteger is 32-bit on watchOS (arm64_32), so this bounds truncation as well as overflow.
+    // Anything smaller is left to the caller's httpRequestBodySizeLimit check.
+    if (result > (NSUIntegerMax - digit) / 10) {
+      return NO;
+    }
+    result = result * 10 + digit;
+  }
+  *outLength = result;
+  return YES;
+}
+
 @interface FBHTTPRoute : NSObject
 @property (nonatomic, copy) NSString *verb;
 @property (nonatomic, strong) NSRegularExpression *regex;
@@ -101,9 +131,19 @@ static NSData * _Nonnull FBUTF8Data(NSString *string)
 // standalone or not (except DELETE /session itself - see -dispatchMethod:). See
 // -abandonPendingRequestsForSessionID:. Guarded by @synchronized(self.pendingSessionRequests).
 @property (nonatomic, strong) NSMutableDictionary<NSString *, NSMutableSet<FBPendingRequest *> *> *pendingSessionRequests;
+// When each connection started waiting for its current request. The reaper closes connections
+// whose entry outlives FBIncompleteRequestTimeout; idle keep-alive connections have no entry and
+// are exempt. Guarded by @synchronized(self.connectionBuffers).
+@property (nonatomic, strong) NSMapTable<id, NSDate *> *incompleteRequestStarts;
+@property (nonatomic, nullable) dispatch_source_t staleConnectionReaper;
 
 @end
 
+// How long a connection may take to deliver a complete request, matching the header read timeout
+// the previous CocoaHTTPServer stack enforced.
+static const NSTimeInterval FBIncompleteRequestTimeout = 30.0;
+static const int64_t FBStaleConnectionSweepIntervalSec = 10;
+
 @implementation FBHTTPServer
 
 - (instancetype)init
@@ -119,6 +159,8 @@ static NSData * _Nonnull FBUTF8Data(NSString *string)
     _connectionsAwaitingResponse = [NSMutableSet set];
     _standaloneWaiters = [NSMutableDictionary dictionary];
     _pendingSessionRequests = [NSMutableDictionary dictionary];
+    _incompleteRequestStarts = [NSMapTable mapTableWithKeyOptions:(NSPointerFunctionsOptions)(NSMapTableObjectPointerPersonality | NSMapTableStrongMemory)
+                                                     valueOptions:(NSPointerFunctionsOptions)NSMapTableStrongMemory];
   }
   return self;
 }
@@ -226,18 +268,56 @@ static NSData * _Nonnull FBUTF8Data(NSString *string)
     return NO;
   }
   self.socket = socket;
+  dispatch_source_t reaper = dispatch_source_create(DISPATCH_SOURCE_TYPE_TIMER, 0, 0, self.bufferProcessingQueue);
+  dispatch_source_set_timer(reaper,
+                            dispatch_time(DISPATCH_TIME_NOW, FBStaleConnectionSweepIntervalSec * NSEC_PER_SEC),
+                            (uint64_t)FBStaleConnectionSweepIntervalSec * NSEC_PER_SEC,
+                            NSEC_PER_SEC);
+  __weak typeof(self) weakSelf = self;
+  dispatch_source_set_event_handler(reaper, ^{
+    [weakSelf reapStaleConnections];
+  });
+  dispatch_resume(reaper);
+  self.staleConnectionReaper = reaper;
   _isRunning = YES;
   return YES;
 }
 
+- (void)reapStaleConnections
+{
+  NSMutableArray *staleConnections = [NSMutableArray array];
+  @synchronized (self.connectionBuffers) {
+    for (id connection in self.incompleteRequestStarts) {
+      // Waiting on the handler, not the peer - never reap, however long the handler takes.
+      if ([self.connectionsAwaitingResponse containsObject:connection]) {
+        continue;
+      }
+      NSDate *start = [self.incompleteRequestStarts objectForKey:connection];
+      if (nil != start && -start.timeIntervalSinceNow > FBIncompleteRequestTimeout) {
+        [staleConnections addObject:connection];
+      }
+    }
+  }
+  for (id connection in staleConnections) {
+    [FBLogger logFmt:@"Closing a connection that did not deliver a complete request within %@ seconds", @(FBIncompleteRequestTimeout)];
+    [self closeClient:(nw_connection_t)connection];
+  }
+}
+
 - (void)stop:(BOOL)immediately
 {
+  dispatch_source_t reaper = self.staleConnectionReaper;
+  if (nil != reaper) {
+    dispatch_source_cancel(reaper);
+    self.staleConnectionReaper = nil;
+  }
   [self.socket stop];
   self.socket = nil;
   @synchronized (self.connectionBuffers) {
     [self.connectionBuffers removeAllObjects];
     [self.pendingRequestHeaders removeAllObjects];
     [self.connectionsAwaitingResponse removeAllObjects];
+    [self.incompleteRequestStarts removeAllObjects];
   }
   _isRunning = NO;
 }
@@ -248,6 +328,8 @@ static NSData * _Nonnull FBUTF8Data(NSString *string)
 {
   @synchronized (self.connectionBuffers) {
     [self.connectionBuffers setObject:[NSMutableData data] forKey:newClient];
+    // Starts at connect, so a peer that connects and then sends nothing is reaped too.
+    [self.incompleteRequestStarts setObject:[NSDate date] forKey:newClient];
   }
 }
 
@@ -257,6 +339,7 @@ static NSData * _Nonnull FBUTF8Data(NSString *string)
     [self.connectionBuffers removeObjectForKey:client];
     [self.pendingRequestHeaders removeObjectForKey:client];
     [self.connectionsAwaitingResponse removeObject:client];
+    [self.incompleteRequestStarts removeObjectForKey:client];
   }
 }
 
@@ -271,12 +354,34 @@ static NSData * _Nonnull FBUTF8Data(NSString *string)
     if (nil == strongSelf) {
       return;
     }
+    BOOL isOverBufferCap = NO;
     @synchronized (strongSelf.connectionBuffers) {
       NSMutableData *buffer = [strongSelf.connectionBuffers objectForKey:client];
       if (nil == buffer) {
         return;
       }
       [buffer appendData:data];
+      // One maximal header block plus one maximal body, plus headroom for a pipelined follow-up.
+      // The per-request checks don't run while a request is executing, so without this cap a
+      // client could pump data unboundedly for as long as its previous request takes.
+      uint64_t bufferCap = FBConfiguration.sharedInstance.httpRequestBodySizeLimit + 2 * (uint64_t)FBMaxRequestHeaderSize;
+      if (bufferCap < FBConfiguration.sharedInstance.httpRequestBodySizeLimit) {
+        bufferCap = UINT64_MAX;
+      }
+      isOverBufferCap = buffer.length > bufferCap;
+      // In the body phase the timeout is an idle bound, refreshed on progress: a declared body
+      // may legitimately be slow and its size is already capped by Content-Length. In the header
+      // phase the clock is only started, never refreshed, so drip-fed headers cannot outlive it.
+      BOOL isBodyPhase = nil != [strongSelf.pendingRequestHeaders objectForKey:client];
+      if (isBodyPhase || nil == [strongSelf.incompleteRequestStarts objectForKey:client]) {
+        [strongSelf.incompleteRequestStarts setObject:[NSDate date] forKey:client];
+      }
+    }
+    if (isOverBufferCap) {
+      // No response owed: a peer this far past any legitimate size is not reading anyway.
+      [FBLogger log:@"Closing a connection that overflowed its request buffer"];
+      [strongSelf closeClient:client];
+      return;
     }
     [strongSelf processBufferForClient:client];
   });
@@ -302,78 +407,183 @@ static NSData * _Nonnull FBUTF8Data(NSString *string)
   }
 
   if (nil == pending) {
-    NSRange headerEndRange = [buffer rangeOfData:FBCRLFCRLFData() options:(NSDataSearchOptions)0 range:NSMakeRange(0, buffer.length)];
-    if (NSNotFound == headerEndRange.location) {
-      // Wait for the rest of the header block to arrive.
+    pending = [self parsedRequestHeaderFromBuffer:buffer forClient:client];
+    if (nil == pending) {
+      // Either the header block is still incomplete, or it was rejected and answered already.
       return;
     }
+    @synchronized (self.connectionBuffers) {
+      [self.pendingRequestHeaders setObject:pending forKey:client];
+    }
+  }
+
+  [self dispatchBufferedRequestWithHeader:pending fromBuffer:buffer forClient:client];
+}
 
-    NSData *headerData = [buffer subdataWithRange:NSMakeRange(0, headerEndRange.location)];
-    NSString *headerString = [[NSString alloc] initWithData:headerData encoding:NSUTF8StringEncoding];
-    NSArray<NSString *> *lines = [headerString componentsSeparatedByString:@"\r\n"];
-    if (lines.count < 1) {
+// Locates the CRLFCRLF that ends the buffered header block and bounds the block's size. Returns
+// NO when nothing can be parsed yet - either because more bytes are needed or because the block
+// was rejected, in which case the 400 has already been written.
+- (BOOL)findHeaderBlockEnd:(out NSRange *)outHeaderEndRange
+                  inBuffer:(NSMutableData *)buffer
+                 forClient:(nw_connection_t)client
+{
+  NSRange headerEndRange = [buffer rangeOfData:FBCRLFCRLFData() options:(NSDataSearchOptions)0 range:NSMakeRange(0, buffer.length)];
+  if (NSNotFound == headerEndRange.location) {
+    if (buffer.length > FBMaxRequestHeaderSize) {
+      // Past any legitimate header block and still unterminated - stop buffering.
       [self respondBadRequestToClient:client];
-      return;
     }
+    // Otherwise wait for the rest of the header block to arrive.
+    return NO;
+  }
+  if (headerEndRange.location > FBMaxRequestHeaderSize) {
+    // The check above only fires while the terminator is missing; one large receive can deliver
+    // an oversized block with it, so bound the completed block too before parsing it.
+    [self respondBadRequestToClient:client];
+    return NO;
+  }
+  *outHeaderEndRange = headerEndRange;
+  return YES;
+}
 
-    NSArray<NSString *> *requestLineParts = [lines.firstObject componentsSeparatedByString:@" "];
-    if (requestLineParts.count < 2) {
+// Turns the header lines that follow the request line into a lowercase-keyed dictionary.
+// Returns nil for the malformed and ambiguous shapes, having written the 400 already.
+- (nullable NSDictionary<NSString *, NSString *> *)parsedHeaderFieldsFromLines:(NSArray<NSString *> *)lines
+                                                                    forClient:(nw_connection_t)client
+{
+  NSMutableDictionary<NSString *, NSString *> *requestHeaders = [NSMutableDictionary dictionary];
+  for (NSUInteger i = 1; i < lines.count; i++) {
+    NSString *line = lines[i];
+    NSRange colonRange = [line rangeOfString:@":"];
+    if (0 == line.length) {
+      continue;
+    }
+    if (NSNotFound == colonRange.location) {
+      // Malformed. Skipping it would drop what it meant to say: "Content-Length 5" would
+      // dispatch with an empty body, leaving its bytes to be parsed as another request.
       [self respondBadRequestToClient:client];
-      return;
+      return nil;
     }
-
-    NSMutableDictionary<NSString *, NSString *> *requestHeaders = [NSMutableDictionary dictionary];
-    for (NSUInteger i = 1; i < lines.count; i++) {
-      NSString *line = lines[i];
-      NSRange colonRange = [line rangeOfString:@":"];
-      if (NSNotFound == colonRange.location) {
-        continue;
-      }
-      NSString *name = [line substringToIndex:colonRange.location];
-      NSString *value = [[line substringFromIndex:colonRange.location + 1]
-                          stringByTrimmingCharactersInSet:NSCharacterSet.whitespaceCharacterSet];
-      requestHeaders[name.lowercaseString] = value;
+    NSString *name = [line substringToIndex:colonRange.location];
+    // RFC 7230 (3.2.4): whitespace before the colon MUST be rejected. Storing "content-length "
+    // as its own key would drop the real header and desync the framing.
+    if (0 == name.length
+        || NSNotFound != [name rangeOfCharacterFromSet:NSCharacterSet.whitespaceAndNewlineCharacterSet].location) {
+      [self respondBadRequestToClient:client];
+      return nil;
     }
-
-    NSString *transferEncoding = requestHeaders[@"transfer-encoding"];
-    if (transferEncoding.length > 0) {
-      // No transfer decoder is implemented at all, so any encoding (chunked or otherwise -
-      // including a value only introduced by a duplicate header overwriting "chunked" above)
-      // is rejected rather than risking the body being misread as empty and desyncing the rest
-      // of the connection's request stream.
-      RouteResponse *notImplemented = [RouteResponse new];
-      id<FBResponsePayload> notImplementedPayload = FBResponseWithStatus([FBCommandStatus invalidArgumentErrorWithMessage:@"Transfer-Encoding is not supported"
-                                                                                                                  traceback:nil]);
-      [notImplementedPayload dispatchWithResponse:notImplemented];
-      [self failClient:client withResponse:notImplemented];
-      return;
+    NSString *value = [[line substringFromIndex:colonRange.location + 1]
+                        stringByTrimmingCharactersInSet:NSCharacterSet.whitespaceCharacterSet];
+    NSString *normalizedName = name.lowercaseString;
+    // RFC 7230 (3.3.3): repeated framing fields are unrecoverable. Last-wins would let an empty
+    // "Transfer-Encoding:" mask an earlier "chunked", and the last Content-Length drive parsing.
+    if (([normalizedName isEqualToString:@"content-length"] || [normalizedName isEqualToString:@"transfer-encoding"])
+        && nil != requestHeaders[normalizedName]) {
+      [self respondBadRequestToClient:client];
+      return nil;
     }
+    requestHeaders[normalizedName] = value;
+  }
+  return requestHeaders;
+}
 
-    NSUInteger contentLength = (NSUInteger)requestHeaders[@"content-length"].integerValue;
-    if (contentLength > FBConfiguration.sharedInstance.httpRequestBodySizeLimit) {
-      // Closes the connection after responding, since the rest of the oversized body is still incoming.
-      RouteResponse *tooLarge = [RouteResponse new];
-      id<FBResponsePayload> tooLargePayload = FBResponseWithStatus([FBCommandStatus invalidArgumentErrorWithMessage:@"The request body exceeds the configured size limit"
-                                                                                                            traceback:nil]);
-      [tooLargePayload dispatchWithResponse:tooLarge];
-      [self failClient:client withResponse:tooLarge];
-      return;
-    }
+// Rejects framing this server cannot honour and resolves the declared body length from the
+// remaining framing headers. Returns NO having written the closing error response already.
+- (BOOL)resolveBodyLength:(out NSUInteger *)outBodyLength
+         fromHeaderFields:(NSDictionary<NSString *, NSString *> *)requestHeaders
+                forClient:(nw_connection_t)client
+{
+  NSString *transferEncoding = requestHeaders[@"transfer-encoding"];
+  if (nil != transferEncoding) {
+    // No transfer decoder exists, so mere presence is rejected - including an empty value,
+    // which is not a valid encoding list and would let the body be misread as empty.
+    RouteResponse *notImplemented = [RouteResponse new];
+    id<FBResponsePayload> notImplementedPayload = FBResponseWithStatus([FBCommandStatus invalidArgumentErrorWithMessage:@"Transfer-Encoding is not supported"
+                                                                                                                traceback:nil]);
+    [notImplementedPayload dispatchWithResponse:notImplemented];
+    [self failClient:client withResponse:notImplemented];
+    return NO;
+  }
 
-    pending = [FBPendingHTTPRequestHeader new];
-    pending.method = requestLineParts[0].uppercaseString;
-    pending.pathAndQuery = requestLineParts[1];
-    pending.bodyStart = headerEndRange.location + headerEndRange.length;
-    pending.contentLength = contentLength;
-    @synchronized (self.connectionBuffers) {
-      [self.pendingRequestHeaders setObject:pending forKey:client];
-    }
+  NSString *contentLengthValue = requestHeaders[@"content-length"];
+  NSUInteger contentLength = 0;
+  if (nil != contentLengthValue && !FBParseContentLength(contentLengthValue, &contentLength)) {
+    // The body's extent is unknowable, so the connection cannot be resynced - reject and close.
+    [self respondBadRequestToClient:client];
+    return NO;
+  }
+  if (contentLength > FBConfiguration.sharedInstance.httpRequestBodySizeLimit) {
+    // Closes the connection after responding, since the rest of the oversized body is still incoming.
+    RouteResponse *tooLarge = [RouteResponse new];
+    id<FBResponsePayload> tooLargePayload = FBResponseWithStatus([FBCommandStatus invalidArgumentErrorWithMessage:@"The request body exceeds the configured size limit"
+                                                                                                          traceback:nil]);
+    [tooLargePayload dispatchWithResponse:tooLarge];
+    [self failClient:client withResponse:tooLarge];
+    return NO;
+  }
+  *outBodyLength = contentLength;
+  return YES;
+}
+
+// Parses the request line and headers of the request at the head of the buffer. Returns nil
+// while the header block is still incomplete, and for a rejected one, which is answered here.
+- (nullable FBPendingHTTPRequestHeader *)parsedRequestHeaderFromBuffer:(NSMutableData *)buffer
+                                                             forClient:(nw_connection_t)client
+{
+  NSRange headerEndRange;
+  if (![self findHeaderBlockEnd:&headerEndRange inBuffer:buffer forClient:client]) {
+    return nil;
+  }
+
+  NSData *headerData = [buffer subdataWithRange:NSMakeRange(0, headerEndRange.location)];
+  NSString *headerString = [[NSString alloc] initWithData:headerData encoding:NSUTF8StringEncoding];
+  NSArray<NSString *> *lines = [headerString componentsSeparatedByString:@"\r\n"];
+  if (lines.count < 1) {
+    [self respondBadRequestToClient:client];
+    return nil;
+  }
+
+  NSArray<NSString *> *requestLineParts = [lines.firstObject componentsSeparatedByString:@" "];
+  if (requestLineParts.count < 2) {
+    [self respondBadRequestToClient:client];
+    return nil;
+  }
+
+  NSDictionary<NSString *, NSString *> *requestHeaders = [self parsedHeaderFieldsFromLines:lines forClient:client];
+  if (nil == requestHeaders) {
+    return nil;
+  }
+  NSUInteger contentLength = 0;
+  if (![self resolveBodyLength:&contentLength fromHeaderFields:requestHeaders forClient:client]) {
+    return nil;
   }
 
+  FBPendingHTTPRequestHeader *pending = [FBPendingHTTPRequestHeader new];
+  pending.method = requestLineParts[0].uppercaseString;
+  pending.pathAndQuery = requestLineParts[1];
+  pending.bodyStart = headerEndRange.location + headerEndRange.length;
+  pending.contentLength = contentLength;
+  return pending;
+}
+
+// Consumes the already-parsed request from the head of the buffer and dispatches it, once its
+// whole body has arrived. Returns with the cached header left in place while it hasn't.
+- (void)dispatchBufferedRequestWithHeader:(FBPendingHTTPRequestHeader *)pending
+                               fromBuffer:(NSMutableData *)buffer
+                                forClient:(nw_connection_t)client
+{
   NSUInteger totalRequestLength = pending.bodyStart + pending.contentLength;
   if (buffer.length < totalRequestLength) {
-    // Wait for the rest of the body to arrive - the parsed header stays cached above, so this
+    // Wait for the rest of the body to arrive - the parsed header stays cached, so this
     // doesn't re-scan/re-parse the header block on every subsequently arriving chunk.
+    @synchronized (self.connectionBuffers) {
+      // The request is now in its body phase, which is idle-bounded rather than hard-bounded.
+      // -client:didReceiveData: samples that phase before this parse runs, so the receive that
+      // completed a slowly-delivered header (and carried the first body bytes) would otherwise
+      // leave the connection on its header-phase timestamp and let the sweep close it despite
+      // the body having just made progress.
+      [self.incompleteRequestStarts setObject:[NSDate date] forKey:client];
+    }
     return;
   }
 
@@ -383,6 +593,14 @@ static NSData * _Nonnull FBUTF8Data(NSString *string)
     [buffer replaceBytesInRange:NSMakeRange(0, totalRequestLength) withBytes:NULL length:0];
     [self.pendingRequestHeaders removeObjectForKey:client];
     [self.connectionsAwaitingResponse addObject:client];
+    if (0 == buffer.length) {
+      // A complete request was delivered and nothing further is buffered: the connection is a
+      // healthy keep-alive and must not be reaped while idle.
+      [self.incompleteRequestStarts removeObjectForKey:client];
+    } else {
+      // Pipelined bytes of the next request are already buffered - restart its clock.
+      [self.incompleteRequestStarts setObject:[NSDate date] forKey:client];
+    }
   }
 
   [self dispatchMethod:pending.method pathAndQuery:pending.pathAndQuery body:body client:client];
@@ -612,19 +830,46 @@ static NSData * _Nonnull FBUTF8Data(NSString *string)
 
   if (shouldClose) {
     __weak typeof(self) weakSelf = self;
-    [self.socket writeData:payload toClient:client completion:^{
+    [self.socket writeData:payload toClient:client completion:^(BOOL didSucceed) {
       [weakSelf closeClient:client];
     }];
   } else {
-    // Sent before unblocking the next pipelined request, so responses can't reach the wire out of order.
-    [self.socket writeData:payload toClient:client];
-    @synchronized (self.connectionBuffers) {
-      [self.connectionsAwaitingResponse removeObject:client];
-    }
+    // Unblocked from the send's completion, not before it: ordering is preserved either way
+    // (nw_connection_send is FIFO per connection), but unblocking early lets a client that
+    // pipelines without reading responses pile up rendered responses inside Network.framework.
     __weak typeof(self) weakSelf = self;
-    dispatch_async(self.bufferProcessingQueue, ^{
-      [weakSelf processBufferForClient:client];
-    });
+    [self.socket writeData:payload toClient:client completion:^(BOOL didSucceed) {
+      __strong typeof(weakSelf) strongSelf = weakSelf;
+      if (nil == strongSelf) {
+        return;
+      }
+      if (!didSucceed) {
+        // The response never reached the peer, so running its next pipelined request - possibly
+        // a mutating one - would change device state for a client that can no longer be answered.
+        [FBLogger log:@"Failed to write a response; dropping the connection and its pending requests"];
+        [strongSelf closeClient:client];
+        return;
+      }
+      // Lifting the exemption and resuming parsing happen in one step on bufferProcessingQueue,
+      // the queue the reaper also runs on: doing it out here exposes the connection to a sweep
+      // queued ahead of the parse, which would judge a buffered request by the previous one's
+      // timestamp.
+      dispatch_async(strongSelf.bufferProcessingQueue, ^{
+        __strong typeof(weakSelf) queuedSelf = weakSelf;
+        if (nil == queuedSelf) {
+          return;
+        }
+        @synchronized (queuedSelf.connectionBuffers) {
+          [queuedSelf.connectionsAwaitingResponse removeObject:client];
+          // Mid-request connections get their window from when parsing could resume, not from the
+          // previous request. Absent entries stay absent, so idle keep-alives remain exempt.
+          if (nil != [queuedSelf.incompleteRequestStarts objectForKey:client]) {
+            [queuedSelf.incompleteRequestStarts setObject:[NSDate date] forKey:client];
+          }
+        }
+        [queuedSelf processBufferForClient:client];
+      });
+    }];
   }
 }
 
@@ -632,7 +877,9 @@ static NSData * _Nonnull FBUTF8Data(NSString *string)
 {
   @synchronized (self.connectionBuffers) {
     [self.connectionBuffers removeObjectForKey:client];
+    [self.pendingRequestHeaders removeObjectForKey:client];
     [self.connectionsAwaitingResponse removeObject:client];
+    [self.incompleteRequestStarts removeObjectForKey:client];
   }
   nw_connection_cancel(client);
 }

package/WebDriverAgentLib/Routing/FBTCPSocket.h

@@ -102,9 +102,11 @@ NS_ASSUME_NONNULL_BEGIN
 
  @param data The data to send
  @param client The destination client
- @param completion Called once the send attempt finishes
+ @param completion Called once the send attempt finishes. `didSucceed` is NO if the send failed
+        (e.g. the peer went away mid-write), in which case nothing was delivered and the caller
+        must not treat the connection as usable.
  */
-- (void)writeData:(NSData *)data toClient:(nw_connection_t)client completion:(nullable void (^)(void))completion;
+- (void)writeData:(NSData *)data toClient:(nw_connection_t)client completion:(nullable void (^)(BOOL didSucceed))completion;
 
 @end
 

package/WebDriverAgentLib/Routing/FBTCPSocket.m

@@ -195,12 +195,15 @@
   [self writeData:data toClient:client completion:nil];
 }
 
-- (void)writeData:(NSData *)data toClient:(nw_connection_t)client completion:(nullable void (^)(void))completion
+- (void)writeData:(NSData *)data toClient:(nw_connection_t)client completion:(nullable void (^)(BOOL didSucceed))completion
 {
   dispatch_data_t dispatchData = dispatch_data_create(data.bytes, data.length, self.socketQueue, DISPATCH_DATA_DESTRUCTOR_DEFAULT);
   nw_connection_send(client, dispatchData, NW_CONNECTION_DEFAULT_STREAM_CONTEXT, false, ^(nw_error_t  _Nullable sendError) {
     if (completion) {
-      completion();
+      // The send error must reach the caller: a failed write means the response never reached
+      // the peer, and treating that as success would e.g. let the next pipelined request run
+      // against a connection that can no longer answer it.
+      completion(nil == sendError);
     }
   });
 }

package/WebDriverAgentTests/UnitTests/FBHTTPServerTests.m

@@ -0,0 +1,264 @@
+/**
+ * Copyright (c) 2015-present, Facebook, Inc.
+ * All rights reserved.
+ *
+ * This source code is licensed under the BSD-style license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+#import <XCTest/XCTest.h>
+
+#import <arpa/inet.h>
+#import <stdatomic.h>
+#import <sys/socket.h>
+#import <unistd.h>
+
+#import "FBHTTPServer.h"
+
+static atomic_int gFramingProbeHits;
+
+// Exercises FBHTTPServer's HTTP framing defenses with raw socket data that URL-loading APIs
+// cannot produce: malformed Content-Length values and header blocks that never terminate.
+@interface FBHTTPServerTests : XCTestCase
+@property (nonatomic, strong) FBHTTPServer *server;
+@property (nonatomic, assign) uint16_t port;
+@end
+
+@implementation FBHTTPServerTests
+
+- (void)setUp
+{
+  [super setUp];
+  atomic_store(&gFramingProbeHits, 0);
+  self.server = [FBHTTPServer new];
+  [self.server handleMethod:@"POST" withPath:@"/framing/probe" block:^(RouteRequest *request, RouteResponse *response) {
+    atomic_fetch_add(&gFramingProbeHits, 1);
+    [response respondWithString:@"probe-ok"];
+  }];
+  [self.server get:@"/framing/ping" withBlock:^(RouteRequest *request, RouteResponse *response) {
+    [response respondWithString:@"pong"];
+  }];
+  self.server.port = 0;
+  NSError *error;
+  XCTAssertTrue([self.server start:&error], @"%@", error);
+  self.port = [[self.server valueForKeyPath:@"socket.port"] unsignedShortValue];
+}
+
+- (void)tearDown
+{
+  [self.server stop:NO];
+  self.server = nil;
+  [super tearDown];
+}
+
+// Sends `payload` as-is and reads until the server closes the connection or `timeout` elapses.
+// Returns everything received (nil on connect failure); *didClose reports whether EOF was seen.
+- (NSString *)responseForRawPayload:(NSData *)payload timeout:(NSTimeInterval)timeout didClose:(BOOL *)didClose
+{
+  *didClose = NO;
+  int fd = socket(AF_INET, SOCK_STREAM, 0);
+  if (fd < 0) {
+    return nil;
+  }
+  int noSigpipe = 1;
+  setsockopt(fd, SOL_SOCKET, SO_NOSIGPIPE, &noSigpipe, sizeof(noSigpipe));
+  struct timeval tv = { .tv_sec = (long)timeout, .tv_usec = 0 };
+  setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
+  struct sockaddr_in addr = { .sin_family = AF_INET, .sin_port = htons(self.port) };
+  addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+  if (0 != connect(fd, (struct sockaddr *)&addr, sizeof(addr))) {
+    close(fd);
+    return nil;
+  }
+  // send(2) may write only part of the payload, which would truncate the multi-KiB flood
+  // payloads into something the server answers differently. Errors stay ignored on purpose:
+  // those same tests expect the server to close the connection mid-send.
+  const uint8_t *bytes = payload.bytes;
+  size_t remaining = payload.length;
+  while (remaining > 0) {
+    ssize_t sent = send(fd, bytes, remaining, 0);
+    if (sent <= 0) {
+      break;
+    }
+    bytes += sent;
+    remaining -= (size_t)sent;
+  }
+  NSMutableData *received = [NSMutableData data];
+  char chunk[4096];
+  NSDate *deadline = [NSDate dateWithTimeIntervalSinceNow:timeout];
+  while (deadline.timeIntervalSinceNow > 0) {
+    ssize_t n = recv(fd, chunk, sizeof(chunk), 0);
+    if (n == 0) {
+      *didClose = YES;
+      break;
+    }
+    if (n < 0) {
+      // A read timeout. Only stop waiting once the response is a keep-alive success, where no
+      // EOF is ever coming; every other response precedes a close, and giving up here would
+      // report didClose = NO for a connection the server is about to drop.
+      NSString *soFar = [[NSString alloc] initWithData:received encoding:NSUTF8StringEncoding] ?: @"";
+      if ([soFar containsString:@"HTTP/1.1 200"]) {
+        break;
+      }
+      continue;
+    }
+    [received appendBytes:chunk length:(NSUInteger)n];
+    // The response has started arriving; poll in short slices from here so a keep-alive success
+    // doesn't sit out the whole timeout waiting for an EOF that never comes.
+    struct timeval drainTv = { .tv_sec = 0, .tv_usec = 200000 };
+    setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &drainTv, sizeof(drainTv));
+  }
+  close(fd);
+  return [[NSString alloc] initWithData:received encoding:NSUTF8StringEncoding] ?: @"";
+}
+
+- (void)testWellFormedRequestStillSucceeds
+{
+  BOOL didClose;
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[@"GET /framing/ping HTTP/1.1\r\n\r\n" dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:5.0
+                                           didClose:&didClose];
+  XCTAssertTrue([response containsString:@"200"], @"%@", response);
+  XCTAssertTrue([response containsString:@"pong"], @"%@", response);
+}
+
+- (void)testNonNumericContentLengthIsRejected
+{
+  // Under -integerValue's lenient parsing "bogus" became 0: the probe route would run with an
+  // empty body and the smuggled GET below would be answered as a second pipelined request.
+  NSString *payload = @"POST /framing/probe HTTP/1.1\r\nContent-Length: bogus\r\n\r\nGET /framing/ping HTTP/1.1\r\n\r\n";
+  BOOL didClose;
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[payload dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:5.0
+                                           didClose:&didClose];
+  XCTAssertTrue([response containsString:@"400"], @"%@", response);
+  XCTAssertFalse([response containsString:@"pong"], @"the smuggled request must not be answered: %@", response);
+  XCTAssertTrue(didClose, @"the connection must be closed after unparseable framing");
+  XCTAssertEqual(atomic_load(&gFramingProbeHits), 0, @"the route must not be dispatched with unknown body extent");
+}
+
+- (void)testWhitespaceBeforeHeaderColonIsRejected
+{
+  // RFC 7230 (3.2.4): whitespace between a field name and its colon MUST be rejected with a 400.
+  // Tolerating it stores "content-length " as a distinct key, dispatches the request with a
+  // zero-length body, and re-parses the declared body as a smuggled pipelined request.
+  NSString *payload = @"POST /framing/probe HTTP/1.1\r\nContent-Length : 5\r\n\r\nhello";
+  BOOL didClose;
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[payload dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:5.0
+                                           didClose:&didClose];
+  XCTAssertTrue([response containsString:@"400"], @"%@", response);
+  XCTAssertTrue(didClose);
+  XCTAssertEqual(atomic_load(&gFramingProbeHits), 0);
+}
+
+- (void)testHeaderLineWithoutColonIsRejected
+{
+  // Silently skipping the malformed line made this dispatch with an empty body while "hello"
+  // stayed in the buffer to be parsed as the next request.
+  NSString *payload = @"POST /framing/probe HTTP/1.1\r\nContent-Length 5\r\n\r\nhello";
+  BOOL didClose;
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[payload dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:5.0
+                                           didClose:&didClose];
+  XCTAssertTrue([response containsString:@"400"], @"%@", response);
+  XCTAssertTrue(didClose);
+  XCTAssertEqual(atomic_load(&gFramingProbeHits), 0);
+}
+
+- (void)testDuplicateContentLengthIsRejected
+{
+  // RFC 7230 (3.3.3): repeated framing fields are unrecoverable. Last-wins assignment would let
+  // the second value drive parsing while an intermediary used the first - a smuggling primitive.
+  NSString *payload = @"POST /framing/probe HTTP/1.1\r\nContent-Length: 5\r\nContent-Length: 0\r\n\r\nhello";
+  BOOL didClose;
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[payload dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:5.0
+                                           didClose:&didClose];
+  XCTAssertTrue([response containsString:@"400"], @"%@", response);
+  XCTAssertTrue(didClose);
+  XCTAssertEqual(atomic_load(&gFramingProbeHits), 0);
+}
+
+- (void)testEmptyTransferEncodingIsRejected
+{
+  // "chunked" followed by an empty value: with last-wins assignment plus a non-empty presence
+  // check, the empty value used to make the header look absent, so the chunked body was parsed
+  // as a zero-length body and its bytes re-read as smuggled requests.
+  NSString *payload = @"POST /framing/probe HTTP/1.1\r\nTransfer-Encoding: chunked\r\nTransfer-Encoding: \r\n\r\n0\r\n\r\n";
+  BOOL didClose;
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[payload dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:5.0
+                                           didClose:&didClose];
+  XCTAssertTrue([response containsString:@"400"] || [response containsString:@"501"], @"%@", response);
+  XCTAssertTrue(didClose);
+  XCTAssertEqual(atomic_load(&gFramingProbeHits), 0);
+}
+
+- (void)testPipelinedRequestsAreServedInOrder
+{
+  // Two requests in one payload: both must be answered on the same connection. Guards the
+  // response backpressure logic - the next pipelined request is only processed once the
+  // previous response's send completed, which must not stall or reorder the pipeline.
+  NSString *payload = @"GET /framing/ping HTTP/1.1\r\n\r\nGET /framing/ping HTTP/1.1\r\n\r\n";
+  BOOL didClose;
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[payload dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:5.0
+                                           didClose:&didClose];
+  NSUInteger pongCount = [response componentsSeparatedByString:@"pong"].count - 1;
+  XCTAssertEqual(pongCount, 2, @"both pipelined requests must be answered: %@", response);
+}
+
+- (void)testPartiallyNumericContentLengthIsRejected
+{
+  NSString *payload = @"POST /framing/probe HTTP/1.1\r\nContent-Length: 5abc\r\n\r\nhello";
+  BOOL didClose;
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[payload dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:5.0
+                                           didClose:&didClose];
+  XCTAssertTrue([response containsString:@"400"], @"%@", response);
+  XCTAssertTrue(didClose);
+  XCTAssertEqual(atomic_load(&gFramingProbeHits), 0);
+}
+
+- (void)testOversizedHeaderBlockIsRejected
+{
+  // A header block that never terminates: 96 KiB of header lines with no \r\n\r\n. The server
+  // must stop buffering and close the connection instead of growing the buffer indefinitely.
+  NSMutableString *payload = [NSMutableString stringWithString:@"GET /framing/ping HTTP/1.1\r\n"];
+  NSString *filler = [@"X-Filler: " stringByAppendingString:[@"" stringByPaddingToLength:1013 withString:@"a" startingAtIndex:0]];
+  while (payload.length < 96 * 1024) {
+    [payload appendString:filler];
+    [payload appendString:@"\r\n"];
+  }
+  BOOL didClose;
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[payload dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:10.0
+                                           didClose:&didClose];
+  XCTAssertTrue([response containsString:@"400"], @"%@", response);
+  XCTAssertTrue(didClose, @"the connection must be closed rather than left buffering");
+}
+
+- (void)testOversizedCompletedHeaderBlockIsRejected
+{
+  // Same flood, but properly terminated with \r\n\r\n. Depending on how the bytes coalesce, the
+  // terminator can arrive in the same receive callback as the bulk of the block, in which case
+  // the incomplete-header cap never fires - the completed block must be rejected too instead of
+  // being copied and parsed.
+  NSMutableString *payload = [NSMutableString stringWithString:@"GET /framing/ping HTTP/1.1\r\n"];
+  NSString *filler = [@"X-Filler: " stringByAppendingString:[@"" stringByPaddingToLength:1013 withString:@"a" startingAtIndex:0]];
+  while (payload.length < 96 * 1024) {
+    [payload appendString:filler];
+    [payload appendString:@"\r\n"];
+  }
+  [payload appendString:@"\r\n"];
+  BOOL didClose;
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[payload dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:10.0
+                                           didClose:&didClose];
+  XCTAssertTrue([response containsString:@"400"], @"%@", response);
+  XCTAssertFalse([response containsString:@"pong"], @"the oversized request must not be served: %@", response);
+  XCTAssertTrue(didClose, @"the connection must be closed rather than left buffering");
+}
+
+@end

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "appium-webdriveragent",
-  "version": "16.9.2",
+  "version": "16.9.3",
   "description": "Package bundling WebDriverAgent",
   "keywords": [
     "Appium",