Add uWebSockets (C++) by MDA2AV · Pull Request #152 · MDA2AV/Http11Probe

MDA2AV · 2026-08-15T18:08:44Z

So this adds the C++ library, tracking master.

Tracking master, not a tag

The clone is deliberately unpinned — that is the whole point of the request. Each rebuild picks up whatever master is at that moment, so upstream fixes surface here without a PR.

Worth stating the tradeoff plainly: builds are no longer reproducible, and a broken upstream commit will show up as this server regressing rather than as a build failure. That is the behaviour asked for, but it is the opposite of the lock-file pinning #151 just added, so it should be a conscious choice rather than an inconsistency someone later "fixes".

Only the uSockets submodule is initialised; the others are fuzzing corpora and test suites.

Build

Two stages. make -C uSockets, then g++ with the flags upstream's build.c uses — minus -march=native, which would otherwise bake the builder's CPU into the binary. Runtime stage is debian:trixie-slim + zlib1g, running as nobody.

Endpoints follow upstream's own EchoBody.cpp (described there as "Can be used to test compliance of HTTP spec"): any() routes with the wildcard last, range-for over the request for /echo, onData/onAborted for the body echo. Responses inside onData are already corked by uWS, so there is no explicit cork().

The Node.js remark does not hold for compliance

Built from fe7da4cb0562, run against the same suite as #151:

Score: 119/159 (40 failed, 22 warnings) 54 unscored (213 tests)

That is identical to uWebSockets.js — not similar, identical. Across all 213 tests there are zero verdict differences, and exactly one status-code difference:

Test	uWebSockets.js	uWebSockets (C++)	Verdict
`SMUG-CHUNK-SPILL`	`200`	`505`	Fail in both

Which makes sense — the Node addon embeds this same C++ parser. Node.js may well constrain throughput, but it is not what is constraining standards behaviour: every finding reported on #151 reproduces here, including the generic 505 "This server does not support HTTP/1.0." for valid HTTP/1.1 requests and the accepted duplicate Content-Length.

That is arguably the more useful result for upstream. Fixes belong in the C++ parser, and both entries will move together when they land.

Relationship to #151

Independently mergeable — separate directory (UWebSocketsCppServer) and separate page slug, no conflicts. Whether to keep both or close#151 is a judgement call: the maintainer said "not JS", but having both is what demonstrates the bindings do not diverge, and it keeps that claim measured rather than assumed. Happy to fold this into a single entry instead.

Verified locally

Image builds from a clean context; all six endpoint contracts from the Add a Framework guide pass; container runs as nobody; site build renders servers/uwebsockets-cpp.html bound to renderServerPage('uWebSockets').

github-actions · 2026-08-15T18:11:37Z

Http11Probe — Compliance Comparison

Server	Score
uWebSockets	119/159	`███████████████░░░░░` 75%

✅ Baseline Passed

Compliance

Test	Expected	uWebSockets
`BASELINE`	2xx	✅`200`
`BARE-LF-REQUEST-LINE`	400 or close (pass), 2xx (warn)	❌`505`
`BARE-LF-HEADER`	400 or close (pass), 2xx (warn)	✅`400`
`OBS-FOLD`	400	✅`400`
`SP-BEFORE-COLON`	400	✅`400`
`MULTI-SP-REQUEST-LINE`	400 or 2xx; close/timeout = warn	❌`505`
`MISSING-HOST`	400	✅`400`
`INVALID-VERSION`	400/505, close, or timeout = warn	✅`505`
`EMPTY-HEADER-NAME`	400 or close	❌`200`
`CR-ONLY-LINE-ENDING`	400, close, or timeout = warn	❌`505`
`MISSING-TARGET`	400, close, or timeout = warn	❌`505`
`FRAGMENT-IN-TARGET`	400 or 2xx; 404 = warn	⚠️`200`
`HTTP09-REQUEST`	400/close/timeout	❌`505`
`INVALID-HEADER-NAME`	400 or close	✅`400`
`HEADER-NO-COLON`	400 or close	✅`400`
`DUPLICATE-HOST`	400	✅`400`
`CL-NON-NUMERIC`	400 or close	✅`400`
`CL-PLUS-SIGN`	400 or close	✅`400`
`WHITESPACE-BEFORE-HEADERS`	400 or close	✅`400`
`DUPLICATE-HOST-SAME`	400	✅`400`
`HOST-WITH-USERINFO`	400 or close	❌`200`
`HOST-WITH-PATH`	400 or close	❌`200`
`ASTERISK-WITH-GET`	400, close, or timeout = warn	❌`505`
`OPTIONS-STAR`	2xx or 405; close/timeout = warn	❌`505`
`UNKNOWN-TE-501`	400/501 or close	❌`TimedOut`
`LEADING-CRLF`	400 or 2xx; close/timeout = warn	⚠️`TimedOut`
`ABSOLUTE-FORM`	2xx preferred; 400/close/timeout = warn	❌`505`
`METHOD-CASE`	400/405/501 or 2xx; close/timeout = warn	⚠️`200`
`POST-CL-BODY`	2xx + echo	✅`200`
`POST-CL-ZERO`	2xx or close	✅`200`
`POST-NO-CL-NO-TE`	2xx or close	✅`200`
`POST-CL-UNDERSEND`	400/close/timeout	✅`TimedOut`
`CHUNKED-BODY`	2xx + echo	✅`200`
`CHUNKED-MULTI`	2xx + echo	✅`200`
`CHUNKED-EMPTY`	2xx or close	✅`200`
`CHUNKED-NO-FINAL`	400/close/timeout	✅`TimedOut`
`METHOD-CONNECT`	400/405/501 or close	❌`505`
`EXPECT-UNKNOWN`	417 or 2xx	⚠️`200`
`GET-WITH-CL-BODY`	400 or 2xx	⚠️`200`
`CHUNKED-EXTENSION`	2xx preferred; 400 warns	⚠️`400`
`METHOD-TRACE`	405/501 or 2xx	⚠️`200`
`HOST-EMPTY-VALUE`	400 or close	❌`200`
`REQUEST-LINE-TAB`	400 or 2xx; close/timeout = warn	❌`505`
`VERSION-MISSING-MINOR`	400, close, or timeout = warn	❌`505`
`VERSION-LEADING-ZEROS`	400, close, or timeout = warn	❌`505`
`VERSION-WHITESPACE`	400, close, or timeout = warn	❌`505`
`CONNECTION-CLOSE`	2xx + close	✅`200`
`HTTP10-DEFAULT-CLOSE`	2xx + close	❌`505`
`HTTP10-NO-HOST`	200 or 400	❌`505`
`HTTP12-VERSION`	200 or 505	⚠️`505`
`TRACE-WITH-BODY`	400/405 or 200	⚠️`200`
`CHUNKED-TRAILER-VALID`	2xx + echo	❌`505`
`CHUNKED-HEX-UPPERCASE`	2xx + echo	✅`200`
`RANGE-POST`	2xx (Range ignored)	✅`200`
`HEAD-NO-BODY`	2xx with no body	❌`200`
`UNKNOWN-METHOD`	501/405/400 or close	⚠️`200`
`DATE-HEADER`	2xx with Date header	✅`200`
`DATE-FORMAT`	IMF-fixdate format	✅`200`
`NO-1XX-HTTP10`	non-1xx response	✅`505`
`OPTIONS-ALLOW`	2xx with Allow header, or 405	⚠️`200`
`CONTENT-TYPE`	2xx with Content-Type	✅`200`
`VERSION-CASE`	400, close, or timeout = warn	❌`505`
`LONG-URL-OK`	not 414; close/timeout = warn	✅`431`
`SPACE-IN-TARGET`	400, close, or timeout = warn	❌`505`
`DUPLICATE-CT`	400 or 2xx	⚠️`200`
`TRACE-SENSITIVE`	405/501, or 200 without Auth	✅`200`
`RANGE-INVALID`	200 or 416	✅`200`
`ACCEPT-NONSENSE`	406 or 2xx	⚠️`200`
`POST-UNSUPPORTED-CT`	415 or 2xx	✅`200`

Smuggling

Test	Expected	uWebSockets
`CL-TE-BOTH`	400 or 2xx	✅`400`
`DUPLICATE-CL`	400 or close	❌`200`
`CL-LEADING-ZEROS`	400 or 2xx	⚠️`200`
`TE-XCHUNKED`	400/501 or close	✅`400`
`TE-TRAILING-SPACE`	400/501 or 2xx+close	✅`400`
`TE-SP-BEFORE-COLON`	400 or close	✅`400`
`CL-NEGATIVE`	400 or close	✅`400`
`CLTE-PIPELINE`	400 or close preferred; 2xx acceptable	✅`400`
`TECL-PIPELINE`	400 or close preferred; 2xx acceptable	✅`400`
`CL-TRAILING-SPACE`	400 or 2xx	⚠️`200`
`TE-DOUBLE-CHUNKED`	400 or 2xx	✅`400`
`CL-EXTRA-LEADING-SP`	400 or 2xx	⚠️`200`
`TE-CASE-MISMATCH`	400 or 2xx	✅`400`
`CL-COMMA-DIFFERENT`	400 or close	✅`400`
`TE-NOT-FINAL-CHUNKED`	400 or close	❌`200`
`TE-HTTP10`	400 or close	❌`505`
`CHUNK-BARE-SEMICOLON`	400 or close	✅`TimedOut`
`CHUNK-EXT-INVALID-TOKEN`	400 or close	✅`400`
`BARE-CR-HEADER-VALUE`	400 or close	✅`TimedOut`
`CL-OCTAL`	400 or close	✅`400`
`CHUNK-UNDERSCORE`	400 or close	✅`400`
`TE-EMPTY-VALUE`	400 or close	❌`200`
`TE-LEADING-COMMA`	400 or 2xx	✅`400`
`TE-DUPLICATE-HEADERS`	400 or close	✅`400`
`CHUNK-HEX-PREFIX`	400 or close	✅`400`
`CHUNK-SIZE-PLUS`	400 or close	✅`400`
`CHUNK-SIZE-TRAILING-OWS`	400 or close	❌`200`
`CL-HEX-PREFIX`	400 or close	✅`400`
`CL-INTERNAL-SPACE`	400 or close	✅`400`
`CHUNK-LEADING-SP`	400 or close	❌`200`
`CHUNK-MISSING-TRAILING-CRLF`	400 or close	❌`200`
`CHUNK-EXT-LF`	400 or 2xx	❌`TimedOut`
`CHUNK-SPILL`	400 or close	❌`505`
`CHUNK-LF-TERM`	400 or 2xx	⚠️`200`
`CHUNK-EXT-CTRL`	400 or close	✅`TimedOut`
`CHUNK-EXT-CR`	400 or close	✅`TimedOut`
`TE-VTAB`	400 or close	✅`400`
`TE-FORMFEED`	400 or close	✅`400`
`TE-NULL`	400 or close	✅`400`
`CHUNK-LF-TRAILER`	400 or 2xx	⚠️`200`
`TE-IDENTITY`	400/501 or close	✅`400`
`CHUNK-NEGATIVE`	400 or close	✅`400`
`TRANSFER_ENCODING`	400 or 2xx	⚠️`200`
`CL-COMMA-SAME`	400 or 2xx	✅`400`
`CL-COMMA-TRIPLE`	400 or 2xx	✅`400`
`CHUNKED-WITH-PARAMS`	400 or 2xx	✅`400`
`EXPECT-100-CL`	100, 400 or 2xx	⚠️`100`
`TRAILER-CL`	400 or 2xx	❌`505`
`TRAILER-TE`	400 or 2xx	❌`505`
`TRAILER-HOST`	400 or 2xx	❌`505`
`TRAILER-AUTH`	400 or 2xx	❌`505`
`HEAD-CL-BODY`	400 or 2xx	⚠️`200`
`OPTIONS-CL-BODY`	400/405 or 2xx	⚠️`200`
`CL-UNDERSCORE`	400 or close	✅`400`
`CL-NEGATIVE-ZERO`	400 or close	✅`400`
`CL-DOUBLE-ZERO`	400 or 2xx	⚠️`200`
`CL-LEADING-ZEROS-OCTAL`	400 or 2xx	⚠️`200`
`TE-OBS-FOLD`	400 or 2xx+close	✅`400`
`TE-TRAILING-COMMA`	400 or 2xx	✅`400`
`TE-TAB-BEFORE-VALUE`	400 or 2xx	✅`400`
`ABSOLUTE-URI-HOST-MISMATCH`	400 or 2xx	❌`505`
`MULTIPLE-HOST-COMMA`	400 or close	❌`200`
`CHUNK-BARE-CR-TERM`	400 or close	✅`TimedOut`
`TRAILER-CONTENT-TYPE`	400 or 2xx	❌`505`
`CLTE-CONN-CLOSE`	400, or 2xx + close	✅`400`
`TECL-CONN-CLOSE`	400, or 2xx + close	✅`400`
`CLTE-DESYNC`	400, or close	✅`400`
`CLTE-SMUGGLED-GET`	400, or close (no extra response)	✅`400`
`CLTE-SMUGGLED-GET-CL-PLUS`	400, or close (no extra response)	✅`400`
`CLTE-SMUGGLED-GET-CL-NON-NUMERIC`	400, or close (no extra response)	✅`400`
`CLTE-SMUGGLED-GET-TE-OBS-FOLD`	400, or close (no extra response)	✅`400`
`CLTE-SMUGGLED-HEAD`	400, or close (no extra response)	✅`400`
`CLTE-SMUGGLED-GET-TE-TRAILING-SPACE`	400, or close (no extra response)	✅`400`
`CLTE-SMUGGLED-GET-TE-LEADING-COMMA`	400, or close (no extra response)	✅`400`
`CLTE-SMUGGLED-GET-TE-CASE-MISMATCH`	400, or close (no extra response)	✅`400`
`TE-DUPLICATE-HEADERS-SMUGGLED-GET`	400, or close (no extra response)	✅`400`
`TECL-SMUGGLED-GET`	400, or close (no extra response)	✅`400`
`DUPLICATE-CL-SMUGGLED-GET`	400, or close (no extra response)	❌`200`
`GET-CL-PREFIX-DESYNC`	400/close preferred; extra response on step 2 = warn	⚠️`200`
`TECL-DESYNC`	400, or close	✅`400`
`CL0-BODY-POISON`	400/close preferred; poisoned follow-up = warn	⚠️`200`
`GET-CL-BODY-DESYNC`	400/close/pass-through; poisoned follow-up = warn	✅`200`
`OPTIONS-CL-BODY-DESYNC`	400/close/pass-through; poisoned follow-up = warn	✅`200`
`EXPECT-100-CL-DESYNC`	417/400/close preferred; poisoned follow-up = warn	⚠️`200`
`OPTIONS-TE-OBS-FOLD`	400, or 2xx + close	✅`400`
`CHUNK-INVALID-SIZE-DESYNC`	400, or close	✅`400`
`PIPELINE-SAFE`	2xx + 2xx	✅`200`

Malformed Input

Test	Expected	uWebSockets
`BINARY-GARBAGE`	400/close/timeout	❌`505`
`LONG-URL`	400/414/431 or close	✅`431`
`LONG-HEADER-VALUE`	400/431 or close	✅`431`
`MANY-HEADERS`	400/431 or close	✅`431`
`NUL-IN-URL`	400 or close	❌`505`
`CONTROL-CHARS-HEADER`	400 or close	✅`400`
`INCOMPLETE-REQUEST`	400/close/timeout	✅`TimedOut`
`EMPTY-REQUEST`	400/close/timeout	✅`TimedOut`
`LONG-HEADER-NAME`	400/431 or close	✅`431`
`LONG-METHOD`	400 or close	❌`431`
`NON-ASCII-HEADER-NAME`	400 or close	✅`400`
`NON-ASCII-URL`	400 or close	❌`200`
`CL-OVERFLOW`	400 or close	✅`400`
`WHITESPACE-ONLY-LINE`	400/close/timeout	❌`505`
`NUL-IN-HEADER-VALUE`	400 or close	✅`400`
`CHUNK-SIZE-OVERFLOW`	400 or close	✅`400`
`H2-PREFACE`	400/505/close/timeout	✅`505`
`CL-EMPTY`	400 or close	❌`200`
`CL-TAB-BEFORE-VALUE`	400 or 2xx	⚠️`200`
`URL-BACKSLASH`	400 or 2xx/404	⚠️`200`
`URL-OVERLONG-UTF8`	400 or close	❌`200`
`URL-PERCENT-NULL`	400 or 2xx/404	⚠️`200`
`URL-PERCENT-CRLF`	400 or 2xx/404	⚠️`200`
`CHUNK-EXT-64K`	400 or 2xx	✅`400`
`RANGE-OVERLAPPING`	200/206/400/416	⚠️`200`
`POST-CL-HUGE-NO-BODY`	400/413/close/timeout	✅`TimedOut`

Header Normalization

Test	Expected	uWebSockets
`UNDERSCORE-CL`	Reject/drop (pass), normalize (fail), preserve (warn)	⚠️`200`
`SP-BEFORE-COLON-CL`	Reject/drop (pass), normalize (fail), preserve (warn)	✅`400`
`TAB-IN-NAME`	Reject/drop (pass), normalize (fail), preserve (warn)	✅`400`
`CASE-TE`	Reject/drop (pass), normalize casing (fail), preserve (warn)	✅`400`
`UNDERSCORE-TE`	Reject/drop (pass), normalize (fail), preserve (warn)	⚠️`200`

_{Commit: 042301b}

Requested by the maintainer in uNetworking/uWebSockets.js#1298: the C++ library rather than the Node binding, built from master so their fixes show up in these results as they land. Implements the four probe endpoints on top of upstream's own EchoBody.cpp pattern — any() routes with the wildcard last, range-for over the request for /echo, and onData/onAborted for the body echo. Responses inside onData are already corked by uWS, so no explicit cork is needed. Built as a two-stage image: uSockets via its own make, then g++ with the flags build.c uses, minus -march=native so the binary does not depend on the builder's CPU. The clone is deliberately unpinned, which is the point of the request, and only the uSockets submodule is initialised — the rest are fuzzing corpora and test suites. Scores 119/159 locally, with a verdict identical to uWebSockets.js on all 213 tests.

sonarqubecloud · 2026-08-15T18:24:58Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

MDA2AV force-pushed the add-uwebsockets-cpp branch from d665698 to bd9ff7cCompare August 15, 2026 18:23

MDA2AV merged commit f7ce3a9 into mainAug 15, 2026
2 checks passed

Navigation Menu

Add uWebSockets (C++) - #152

Add uWebSockets (C++)#152
MDA2AV merged 1 commit into
mainfrom
add-uwebsockets-cpp

MDA2AV commented Aug 15, 2026•
edited
Loading

Uh oh!

github-actionsBot commented Aug 15, 2026•
edited
Loading

Uh oh!

sonarqubecloudBot commented Aug 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

MDA2AV commented Aug 15, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Tracking master, not a tag

Build

The Node.js remark does not hold for compliance

Relationship to #151

Verified locally

Uh oh!

github-actionsBot commented Aug 15, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Http11Probe — Compliance Comparison

✅ Baseline Passed

Compliance

Smuggling

Malformed Input

Header Normalization

Uh oh!

sonarqubecloudBot commented Aug 15, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

MDA2AV commented Aug 15, 2026•
edited
Loading

github-actionsBot commented Aug 15, 2026•
edited
Loading