Strictly require CRLF when parsing HTTP/1.1 chunked encoding lines

[Copilot]

Per RFC 9112, interpreting a lone LF as CRLF is only permitted for the status line and headers — chunked encoding data lines must be terminated by CRLF. SocketsHttpHandler used the same lenient line parsing everywhere, so it accepted lone CR bytes in chunk extensions and a single LF for chunk termination.

Changes

• HttpConnection.TryReadNextChunkedLine: Reworked to strictly require CRLF for the chunk size line and chunk terminator. It now locates the first CR/LF and rejects a bare LF (lone-LF termination) or a CR not immediately followed by LF (bare CR in size line/extension). The MaxChunkBytesAllowed limit and partial-buffer "wait for more data" behavior are unchanged.
• Strings.resx: Added net_http_invalid_response_chunk_line_ending, thrown as HttpIOException(InvalidResponse, ...).
• Tests: New SocketsHttpHandler_ChunkedEncodingParsing_Test covering valid CRLF (incl. chunk extensions and trailers) and rejection of lone-LF at multiple positions and bare CR in the size line/extension.

Scope note

Chunked trailers (after 0\r\n) are parsed by the header parser and remain intentionally lenient per spec; this change only tightens the chunk size line and chunk terminator.

Behavioral delta (all valid CRLF inputs unchanged):

Input	Before	After
4\r\n	accept	accept
4\n	accept	reject
4;ext\rval\r\n (bare CR in ext)	accept	reject
data\n terminator (lone LF)	accept	reject

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[azure-pipelines]

Azure Pipelines:
16 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

[dotnet-policy-service]

Tagging subscribers to this area: @karelz, @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

[MihaZupan]

@copilot Address all review feedback

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

@copilot Address all review feedback

Addressed in d3a2545.

Updated the HttpConnection bounds checks to the unsigned idiom, reformatted the loopback response send into a separate block, and tightened the chunked parsing test to assert HttpRequestError.InvalidResponse / HttpIOException while using IgnoreExceptions(...) for the server-side race.

Note

This comment was created by GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 4 pipeline(s).
12 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.