fix: reject a request-line part that cannot be sent as given

[pjfanning]

Motivation

The HTTP/1.1 request line has two parts the application supplies, and the renderer writes both as given (HttpRequestRendererFactory.scala:48-53):

r ~~ method ~~ ' '
...
case `Raw-Request-URI`(rawUri) =>
  r ~~ rawUri; true

No check on what either contains. Two things go wrong with an unchecked value:

• A space, CR or LF ends the part early and lets whatever follows be read as the target, the protocol, a header, or a second request. An application that builds a Raw-Request-URI — or a custom method name — from input it did not validate has a request-line injection.
• Rendering.~~(String) writes a string one char at a time truncated to a byte (array(oldSize) = char.toByte), so a character outside ASCII does not arrive as itself. U+010D (č) lands on the wire as 0x0D — a CR — without the value ever containing one.

Over HTTP/2 the same two values become :method and (since #1280) :path, where #1258's HPACK guard drops a field carrying CR, LF or NUL. That's a malformed request rather than an injection, but a silent one.

Modification

The fix: validate on construction, matching the existing Referer idiom.

• Raw-Request-URI must be non-empty and visible ASCII only (0x21–0x7E). That's the set a request target may contain on the wire (RFC 9112 §3.2), and coincidentally the only set the renderer can send faithfully. Constructor validation covers every path in one place: copy, the Java RawRequestURI.create, and the HTTP/2 :path route from feat: honour Raw-Request-URI as the HTTP/2 :path #1280 — so the HPACK guard's silent drop of :path can no longer be reached from this header either.
• HttpMethod.custom must be a token (RFC 9110 §5.6.2), checked with the parser's own tchar class in both overloads that construct a method; the single-argument overload and the Java HttpMethods.custom delegate to them. Same reasoning, same coverage of :method.

Both fail with an IllegalArgumentException naming the character and its index:

Raw-Request-URI may only contain visible ASCII characters (0x21-0x7E), the request target is sent to the wire as given: found U+0020 at index 2
an HTTP method name must be a token (RFC 9110 section 5.6.2), it is written into the request line as given: found U+0020 at index 3

Neither check touches the server side. The header created under raw-request-uri-header = on is built from a target the URI parser has already accepted, which is visible ASCII by construction; and the server never constructs a method from wire bytes — it looks the parsed token up among the registered custom methods.

Documented in the scaladoc, in the Raw-Request-URI and custom-method sections of the model docs (with the warning not to build either from unvalidated request input), and the HTTP/2 renderer's comment on Raw-Request-URI — which still said the value was taken on trust — is corrected.

Result

Neither part of the request line an application can supply can carry a character that would corrupt it, or that the renderer would corrupt, and neither can reach the HPACK guard's silent drop of a pseudo-header. Either is rejected where the application creates it, instead of being sent.

Tests

• HeaderSpec: the full visible-ASCII range and the existing %80%fe%ff value are accepted; space, CR+LF, LF, tab, NUL, DEL, two non-ASCII characters, the empty string and a copy are each rejected, and the message names the offending character.
• HttpMethodsSpec: every tchar and two real-world custom methods are accepted; a request-line injection, CR+LF, tab, NUL, DEL, /, :, a non-ASCII character, the empty string and the five-argument overload are each rejected.
• Both rejecting cases fail with their validation reverted.
• sbt "http-core/testOnly ...HeaderSpec ...HttpMethodsSpec ...RequestRendererSpec ...RequestParserCRLFSpec ...HttpHeaderSpec ...NewConnectionPoolSpec" — pass (the last three register custom methods or the header).
• sbt "http2-tests/testOnly ...Http2ClientSpec" (the two Raw-Request-URI cases from feat: honour Raw-Request-URI as the HTTP/2 :path #1280) and sbt "docs/testOnly ...ModelSpec ...ModelDocTest" — pass.
• sbt "http-core/mimaReportBinaryIssues" — pass.
• Native scalafmt --list --mode diff-ref=upstream/main — clean.

References

Refs #1280