Add Fulmine.js server

[nigrosimone]

Adds Fulmine.js as a server under test. It is a
drop-in Express 5 replacement that runs on uWebSockets.js, so its HTTP parsing is µWS's rather than
node's, and the probe says something quite different about it than about Express: 128/159 here
against Express's 147/157 on the same machine, and almost every difference is in the request line
and the chunked framing.

There is no server.js in this directory on purpose. The package is installed under the name
express, so the Dockerfile copies ExpressServer/server.js and runs it unchanged: what is probed
is the same application as the Express row with only the framework behind it swapped, which is the
claim this project exists to make. It also means the two rows cannot drift apart when that file
changes.

Two things about the Dockerfile are forced by uWebSockets.js: it is installed from a git tag rather
than from the registry, so the image needs git and an https rewrite, and its prebuilt binary needs
glibc 2.38, so the base image is node:22-trixie-slim and not -slim.

Ran locally the way the workflow does, with the container on --network host: 128/159, 213 tests,
no errors.

One note on the Sonar gate: it fails on the security rating, and what is left is the missing lock
file. .gitignore excludes lock files repo-wide, so this uses npm install with the version pinned
exactly rather than npm ci. Say the word and I will commit a package-lock.json for this
directory with an exception in .gitignore.

[github-actions]

Http11Probe — Compliance Comparison

Server	Score
Fulmine.js	128/159	████████████████░░░░ 81%

✅ Baseline Passed

Compliance

Test	Expected	Fulmine.js
BASELINE	2xx	✅200
BARE-LF-REQUEST-LINE	400 or close (pass), 2xx (warn)	❌505
BARE-LF-HEADER	400 or close (pass), 2xx (warn)	✅400
OBS-FOLD	400	✅400
SP-BEFORE-COLON	400	✅400
MULTI-SP-REQUEST-LINE	400 or 2xx; close/timeout = warn	❌505
MISSING-HOST	400	✅400
INVALID-VERSION	400/505, close, or timeout = warn	✅505
EMPTY-HEADER-NAME	400 or close	❌200
CR-ONLY-LINE-ENDING	400, close, or timeout = warn	❌505
MISSING-TARGET	400, close, or timeout = warn	❌505
FRAGMENT-IN-TARGET	400 or 2xx; 404 = warn	⚠️404
HTTP09-REQUEST	400/close/timeout	❌505
INVALID-HEADER-NAME	400 or close	✅400
HEADER-NO-COLON	400 or close	✅400
DUPLICATE-HOST	400	✅400
CL-NON-NUMERIC	400 or close	✅ClosedByServer
CL-PLUS-SIGN	400 or close	✅ClosedByServer
WHITESPACE-BEFORE-HEADERS	400 or close	✅400
DUPLICATE-HOST-SAME	400	✅400
HOST-WITH-USERINFO	400 or close	❌200
HOST-WITH-PATH	400 or close	❌200
ASTERISK-WITH-GET	400, close, or timeout = warn	❌505
OPTIONS-STAR	2xx or 405; close/timeout = warn	❌505
UNKNOWN-TE-501	400/501 or close	✅ClosedByServer
LEADING-CRLF	400 or 2xx; close/timeout = warn	⚠️TimedOut
ABSOLUTE-FORM	2xx preferred; 400/close/timeout = warn	❌505
METHOD-CASE	400/405/501 or 2xx; close/timeout = warn	⚠️ClosedByServer
POST-CL-BODY	2xx + echo	✅200
POST-CL-ZERO	2xx or close	✅200
POST-NO-CL-NO-TE	2xx or close	✅200
POST-CL-UNDERSEND	400/close/timeout	✅TimedOut
CHUNKED-BODY	2xx + echo	✅200
CHUNKED-MULTI	2xx + echo	✅200
CHUNKED-EMPTY	2xx or close	✅200
CHUNKED-NO-FINAL	400/close/timeout	✅TimedOut
METHOD-CONNECT	400/405/501 or close	❌505
EXPECT-UNKNOWN	417 or 2xx	⚠️200
GET-WITH-CL-BODY	400 or 2xx	⚠️200
CHUNKED-EXTENSION	2xx preferred; 400 warns	⚠️400
METHOD-TRACE	405/501 or 2xx	❌404
HOST-EMPTY-VALUE	400 or close	❌200
REQUEST-LINE-TAB	400 or 2xx; close/timeout = warn	❌505
VERSION-MISSING-MINOR	400, close, or timeout = warn	❌505
VERSION-LEADING-ZEROS	400, close, or timeout = warn	❌505
VERSION-WHITESPACE	400, close, or timeout = warn	❌505
CONNECTION-CLOSE	2xx + close	✅200
HTTP10-DEFAULT-CLOSE	2xx + close	❌505
HTTP10-NO-HOST	200 or 400	❌505
HTTP12-VERSION	200 or 505	⚠️505
TRACE-WITH-BODY	400/405 or 200	❌404
CHUNKED-TRAILER-VALID	2xx + echo	❌505
CHUNKED-HEX-UPPERCASE	2xx + echo	✅200
RANGE-POST	2xx (Range ignored)	✅200
HEAD-NO-BODY	2xx with no body	✅200
UNKNOWN-METHOD	501/405/400 or close	✅ClosedByServer
DATE-HEADER	2xx with Date header	✅200
DATE-FORMAT	IMF-fixdate format	✅200
NO-1XX-HTTP10	non-1xx response	✅505
OPTIONS-ALLOW	2xx with Allow header, or 405	✅200
CONTENT-TYPE	2xx with Content-Type	✅200
VERSION-CASE	400, close, or timeout = warn	❌505
LONG-URL-OK	not 414; close/timeout = warn	✅431
SPACE-IN-TARGET	400, close, or timeout = warn	❌505
DUPLICATE-CT	400 or 2xx	⚠️200
TRACE-SENSITIVE	405/501, or 200 without Auth	❌404
RANGE-INVALID	200 or 416	✅200
ACCEPT-NONSENSE	406 or 2xx	⚠️200
POST-UNSUPPORTED-CT	415 or 2xx	✅200

Smuggling

Test	Expected	Fulmine.js
CL-TE-BOTH	400 or 2xx	✅400
DUPLICATE-CL	400 or close	✅ClosedByServer
CL-LEADING-ZEROS	400 or 2xx	⚠️200
TE-XCHUNKED	400/501 or close	✅400
TE-TRAILING-SPACE	400/501 or 2xx+close	✅400
TE-SP-BEFORE-COLON	400 or close	✅400
CL-NEGATIVE	400 or close	✅ClosedByServer
CLTE-PIPELINE	400 or close preferred; 2xx acceptable	✅400
TECL-PIPELINE	400 or close preferred; 2xx acceptable	✅400
CL-TRAILING-SPACE	400 or 2xx	⚠️200
TE-DOUBLE-CHUNKED	400 or 2xx	✅400
CL-EXTRA-LEADING-SP	400 or 2xx	⚠️200
TE-CASE-MISMATCH	400 or 2xx	✅400
CL-COMMA-DIFFERENT	400 or close	✅ClosedByServer
TE-NOT-FINAL-CHUNKED	400 or close	✅ClosedByServer
TE-HTTP10	400 or close	❌505
CHUNK-BARE-SEMICOLON	400 or close	✅TimedOut
CHUNK-EXT-INVALID-TOKEN	400 or close	✅400
BARE-CR-HEADER-VALUE	400 or close	✅TimedOut
CL-OCTAL	400 or close	✅ClosedByServer
CHUNK-UNDERSCORE	400 or close	✅400
TE-EMPTY-VALUE	400 or close	✅ClosedByServer
TE-LEADING-COMMA	400 or 2xx	✅400
TE-DUPLICATE-HEADERS	400 or close	✅400
CHUNK-HEX-PREFIX	400 or close	✅400
CHUNK-SIZE-PLUS	400 or close	✅400
CHUNK-SIZE-TRAILING-OWS	400 or close	❌200
CL-HEX-PREFIX	400 or close	✅ClosedByServer
CL-INTERNAL-SPACE	400 or close	✅ClosedByServer
CHUNK-LEADING-SP	400 or close	❌200
CHUNK-MISSING-TRAILING-CRLF	400 or close	❌200
CHUNK-EXT-LF	400 or 2xx	❌TimedOut
CHUNK-SPILL	400 or close	❌200
CHUNK-LF-TERM	400 or 2xx	⚠️200
CHUNK-EXT-CTRL	400 or close	✅TimedOut
CHUNK-EXT-CR	400 or close	✅TimedOut
TE-VTAB	400 or close	✅400
TE-FORMFEED	400 or close	✅400
TE-NULL	400 or close	✅400
CHUNK-LF-TRAILER	400 or 2xx	⚠️200
TE-IDENTITY	400/501 or close	✅400
CHUNK-NEGATIVE	400 or close	✅400
TRANSFER_ENCODING	400 or 2xx	⚠️200
CL-COMMA-SAME	400 or 2xx	✅ClosedByServer
CL-COMMA-TRIPLE	400 or 2xx	✅ClosedByServer
CHUNKED-WITH-PARAMS	400 or 2xx	✅400
EXPECT-100-CL	100, 400 or 2xx	⚠️100
TRAILER-CL	400 or 2xx	❌505
TRAILER-TE	400 or 2xx	❌505
TRAILER-HOST	400 or 2xx	❌505
TRAILER-AUTH	400 or 2xx	❌505
HEAD-CL-BODY	400 or 2xx	⚠️200
OPTIONS-CL-BODY	400/405 or 2xx	⚠️200
CL-UNDERSCORE	400 or close	✅ClosedByServer
CL-NEGATIVE-ZERO	400 or close	✅ClosedByServer
CL-DOUBLE-ZERO	400 or 2xx	⚠️200
CL-LEADING-ZEROS-OCTAL	400 or 2xx	⚠️200
TE-OBS-FOLD	400 or 2xx+close	✅400
TE-TRAILING-COMMA	400 or 2xx	✅400
TE-TAB-BEFORE-VALUE	400 or 2xx	✅400
ABSOLUTE-URI-HOST-MISMATCH	400 or 2xx	❌505
MULTIPLE-HOST-COMMA	400 or close	❌200
CHUNK-BARE-CR-TERM	400 or close	✅TimedOut
TRAILER-CONTENT-TYPE	400 or 2xx	❌505
CLTE-CONN-CLOSE	400, or 2xx + close	✅400
TECL-CONN-CLOSE	400, or 2xx + close	✅400
CLTE-DESYNC	400, or close	✅400
CLTE-SMUGGLED-GET	400, or close (no extra response)	✅400
CLTE-SMUGGLED-GET-CL-PLUS	400, or close (no extra response)	✅400
CLTE-SMUGGLED-GET-CL-NON-NUMERIC	400, or close (no extra response)	✅400
CLTE-SMUGGLED-GET-TE-OBS-FOLD	400, or close (no extra response)	✅400
CLTE-SMUGGLED-HEAD	400, or close (no extra response)	✅400
CLTE-SMUGGLED-GET-TE-TRAILING-SPACE	400, or close (no extra response)	✅400
CLTE-SMUGGLED-GET-TE-LEADING-COMMA	400, or close (no extra response)	✅400
CLTE-SMUGGLED-GET-TE-CASE-MISMATCH	400, or close (no extra response)	✅400
TE-DUPLICATE-HEADERS-SMUGGLED-GET	400, or close (no extra response)	✅400
TECL-SMUGGLED-GET	400, or close (no extra response)	✅400
DUPLICATE-CL-SMUGGLED-GET	400, or close (no extra response)	✅ClosedByServer
GET-CL-PREFIX-DESYNC	400/close preferred; extra response on step 2 = warn	⚠️200
TECL-DESYNC	400, or close	✅400
CL0-BODY-POISON	400/close preferred; poisoned follow-up = warn	⚠️200
GET-CL-BODY-DESYNC	400/close/pass-through; poisoned follow-up = warn	✅200
OPTIONS-CL-BODY-DESYNC	400/close/pass-through; poisoned follow-up = warn	✅200
EXPECT-100-CL-DESYNC	417/400/close preferred; poisoned follow-up = warn	⚠️200
OPTIONS-TE-OBS-FOLD	400, or 2xx + close	✅400
CHUNK-INVALID-SIZE-DESYNC	400, or close	✅400
PIPELINE-SAFE	2xx + 2xx	✅200

Malformed Input

Test	Expected	Fulmine.js
BINARY-GARBAGE	400/close/timeout	❌505
LONG-URL	400/414/431 or close	✅431
LONG-HEADER-VALUE	400/431 or close	✅431
MANY-HEADERS	400/431 or close	✅431
NUL-IN-URL	400 or close	❌505
CONTROL-CHARS-HEADER	400 or close	✅400
INCOMPLETE-REQUEST	400/close/timeout	✅TimedOut
EMPTY-REQUEST	400/close/timeout	✅TimedOut
LONG-HEADER-NAME	400/431 or close	✅431
LONG-METHOD	400 or close	❌431
NON-ASCII-HEADER-NAME	400 or close	✅400
NON-ASCII-URL	400 or close	✅ClosedByServer
CL-OVERFLOW	400 or close	✅ClosedByServer
WHITESPACE-ONLY-LINE	400/close/timeout	❌505
NUL-IN-HEADER-VALUE	400 or close	✅400
CHUNK-SIZE-OVERFLOW	400 or close	✅400
H2-PREFACE	400/505/close/timeout	✅505
CL-EMPTY	400 or close	✅ClosedByServer
CL-TAB-BEFORE-VALUE	400 or 2xx	⚠️200
URL-BACKSLASH	400 or 2xx/404	⚠️404
URL-OVERLONG-UTF8	400 or close	✅ClosedByServer
URL-PERCENT-NULL	400 or 2xx/404	⚠️404
URL-PERCENT-CRLF	400 or 2xx/404	⚠️404
CHUNK-EXT-64K	400 or 2xx	✅400
RANGE-OVERLAPPING	200/206/400/416	⚠️200
POST-CL-HUGE-NO-BODY	400/413/close/timeout	✅TimedOut

Header Normalization

Test	Expected	Fulmine.js
UNDERSCORE-CL	Reject/drop (pass), normalize (fail), preserve (warn)	⚠️200
SP-BEFORE-COLON-CL	Reject/drop (pass), normalize (fail), preserve (warn)	✅400
TAB-IN-NAME	Reject/drop (pass), normalize (fail), preserve (warn)	✅400
CASE-TE	Reject/drop (pass), normalize casing (fail), preserve (warn)	✅400
UNDERSCORE-TE	Reject/drop (pass), normalize (fail), preserve (warn)	⚠️200

_{Commit: 20bb54c}

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE