Add uWebSockets (C++)

[MDA2AV]

So this adds the C++ library, tracking master.

Tracking master, not a tag

The clone is deliberately unpinned — that is the whole point of the request. Each rebuild picks up whatever master is at that moment, so upstream fixes surface here without a PR.

Worth stating the tradeoff plainly: builds are no longer reproducible, and a broken upstream commit will show up as this server regressing rather than as a build failure. That is the behaviour asked for, but it is the opposite of the lock-file pinning #151 just added, so it should be a conscious choice rather than an inconsistency someone later "fixes".

Only the uSockets submodule is initialised; the others are fuzzing corpora and test suites.

Build

Two stages. make -C uSockets, then g++ with the flags upstream's build.c uses — minus -march=native, which would otherwise bake the builder's CPU into the binary. Runtime stage is debian:trixie-slim + zlib1g, running as nobody.

Endpoints follow upstream's own EchoBody.cpp (described there as "Can be used to test compliance of HTTP spec"): any() routes with the wildcard last, range-for over the request for /echo, onData/onAborted for the body echo. Responses inside onData are already corked by uWS, so there is no explicit cork().

The Node.js remark does not hold for compliance

Built from fe7da4cb0562, run against the same suite as #151:

Score: 119/159 (40 failed, 22 warnings)  54 unscored  (213 tests)

That is identical to uWebSockets.js — not similar, identical. Across all 213 tests there are zero verdict differences, and exactly one status-code difference:

Test	uWebSockets.js	uWebSockets (C++)	Verdict
SMUG-CHUNK-SPILL	200	505	Fail in both

Which makes sense — the Node addon embeds this same C++ parser. Node.js may well constrain throughput, but it is not what is constraining standards behaviour: every finding reported on #151 reproduces here, including the generic 505 "This server does not support HTTP/1.0." for valid HTTP/1.1 requests and the accepted duplicate Content-Length.

That is arguably the more useful result for upstream. Fixes belong in the C++ parser, and both entries will move together when they land.

Relationship to #151

Independently mergeable — separate directory (UWebSocketsCppServer) and separate page slug, no conflicts. Whether to keep both or close #151 is a judgement call: the maintainer said "not JS", but having both is what demonstrates the bindings do not diverge, and it keeps that claim measured rather than assumed. Happy to fold this into a single entry instead.

Verified locally

Image builds from a clean context; all six endpoint contracts from the Add a Framework guide pass; container runs as nobody; site build renders servers/uwebsockets-cpp.html bound to renderServerPage('uWebSockets').

[github-actions]

Http11Probe — Compliance Comparison

Server	Score
uWebSockets	119/159	███████████████░░░░░ 75%

✅ Baseline Passed

Compliance

Test	Expected	uWebSockets
BASELINE	2xx	✅200
BARE-LF-REQUEST-LINE	400 or close (pass), 2xx (warn)	❌505
BARE-LF-HEADER	400 or close (pass), 2xx (warn)	✅400
OBS-FOLD	400	✅400
SP-BEFORE-COLON	400	✅400
MULTI-SP-REQUEST-LINE	400 or 2xx; close/timeout = warn	❌505
MISSING-HOST	400	✅400
INVALID-VERSION	400/505, close, or timeout = warn	✅505
EMPTY-HEADER-NAME	400 or close	❌200
CR-ONLY-LINE-ENDING	400, close, or timeout = warn	❌505
MISSING-TARGET	400, close, or timeout = warn	❌505
FRAGMENT-IN-TARGET	400 or 2xx; 404 = warn	⚠️200
HTTP09-REQUEST	400/close/timeout	❌505
INVALID-HEADER-NAME	400 or close	✅400
HEADER-NO-COLON	400 or close	✅400
DUPLICATE-HOST	400	✅400
CL-NON-NUMERIC	400 or close	✅400
CL-PLUS-SIGN	400 or close	✅400
WHITESPACE-BEFORE-HEADERS	400 or close	✅400
DUPLICATE-HOST-SAME	400	✅400
HOST-WITH-USERINFO	400 or close	❌200
HOST-WITH-PATH	400 or close	❌200
ASTERISK-WITH-GET	400, close, or timeout = warn	❌505
OPTIONS-STAR	2xx or 405; close/timeout = warn	❌505
UNKNOWN-TE-501	400/501 or close	❌TimedOut
LEADING-CRLF	400 or 2xx; close/timeout = warn	⚠️TimedOut
ABSOLUTE-FORM	2xx preferred; 400/close/timeout = warn	❌505
METHOD-CASE	400/405/501 or 2xx; close/timeout = warn	⚠️200
POST-CL-BODY	2xx + echo	✅200
POST-CL-ZERO	2xx or close	✅200
POST-NO-CL-NO-TE	2xx or close	✅200
POST-CL-UNDERSEND	400/close/timeout	✅TimedOut
CHUNKED-BODY	2xx + echo	✅200
CHUNKED-MULTI	2xx + echo	✅200
CHUNKED-EMPTY	2xx or close	✅200
CHUNKED-NO-FINAL	400/close/timeout	✅TimedOut
METHOD-CONNECT	400/405/501 or close	❌505
EXPECT-UNKNOWN	417 or 2xx	⚠️200
GET-WITH-CL-BODY	400 or 2xx	⚠️200
CHUNKED-EXTENSION	2xx preferred; 400 warns	⚠️400
METHOD-TRACE	405/501 or 2xx	⚠️200
HOST-EMPTY-VALUE	400 or close	❌200
REQUEST-LINE-TAB	400 or 2xx; close/timeout = warn	❌505
VERSION-MISSING-MINOR	400, close, or timeout = warn	❌505
VERSION-LEADING-ZEROS	400, close, or timeout = warn	❌505
VERSION-WHITESPACE	400, close, or timeout = warn	❌505
CONNECTION-CLOSE	2xx + close	✅200
HTTP10-DEFAULT-CLOSE	2xx + close	❌505
HTTP10-NO-HOST	200 or 400	❌505
HTTP12-VERSION	200 or 505	⚠️505
TRACE-WITH-BODY	400/405 or 200	⚠️200
CHUNKED-TRAILER-VALID	2xx + echo	❌505
CHUNKED-HEX-UPPERCASE	2xx + echo	✅200
RANGE-POST	2xx (Range ignored)	✅200
HEAD-NO-BODY	2xx with no body	❌200
UNKNOWN-METHOD	501/405/400 or close	⚠️200
DATE-HEADER	2xx with Date header	✅200
DATE-FORMAT	IMF-fixdate format	✅200
NO-1XX-HTTP10	non-1xx response	✅505
OPTIONS-ALLOW	2xx with Allow header, or 405	⚠️200
CONTENT-TYPE	2xx with Content-Type	✅200
VERSION-CASE	400, close, or timeout = warn	❌505
LONG-URL-OK	not 414; close/timeout = warn	✅431
SPACE-IN-TARGET	400, close, or timeout = warn	❌505
DUPLICATE-CT	400 or 2xx	⚠️200
TRACE-SENSITIVE	405/501, or 200 without Auth	✅200
RANGE-INVALID	200 or 416	✅200
ACCEPT-NONSENSE	406 or 2xx	⚠️200
POST-UNSUPPORTED-CT	415 or 2xx	✅200

Smuggling

Test	Expected	uWebSockets
CL-TE-BOTH	400 or 2xx	✅400
DUPLICATE-CL	400 or close	❌200
CL-LEADING-ZEROS	400 or 2xx	⚠️200
TE-XCHUNKED	400/501 or close	✅400
TE-TRAILING-SPACE	400/501 or 2xx+close	✅400
TE-SP-BEFORE-COLON	400 or close	✅400
CL-NEGATIVE	400 or close	✅400
CLTE-PIPELINE	400 or close preferred; 2xx acceptable	✅400
TECL-PIPELINE	400 or close preferred; 2xx acceptable	✅400
CL-TRAILING-SPACE	400 or 2xx	⚠️200
TE-DOUBLE-CHUNKED	400 or 2xx	✅400
CL-EXTRA-LEADING-SP	400 or 2xx	⚠️200
TE-CASE-MISMATCH	400 or 2xx	✅400
CL-COMMA-DIFFERENT	400 or close	✅400
TE-NOT-FINAL-CHUNKED	400 or close	❌200
TE-HTTP10	400 or close	❌505
CHUNK-BARE-SEMICOLON	400 or close	✅TimedOut
CHUNK-EXT-INVALID-TOKEN	400 or close	✅400
BARE-CR-HEADER-VALUE	400 or close	✅TimedOut
CL-OCTAL	400 or close	✅400
CHUNK-UNDERSCORE	400 or close	✅400
TE-EMPTY-VALUE	400 or close	❌200
TE-LEADING-COMMA	400 or 2xx	✅400
TE-DUPLICATE-HEADERS	400 or close	✅400
CHUNK-HEX-PREFIX	400 or close	✅400
CHUNK-SIZE-PLUS	400 or close	✅400
CHUNK-SIZE-TRAILING-OWS	400 or close	❌200
CL-HEX-PREFIX	400 or close	✅400
CL-INTERNAL-SPACE	400 or close	✅400
CHUNK-LEADING-SP	400 or close	❌200
CHUNK-MISSING-TRAILING-CRLF	400 or close	❌200
CHUNK-EXT-LF	400 or 2xx	❌TimedOut
CHUNK-SPILL	400 or close	❌505
CHUNK-LF-TERM	400 or 2xx	⚠️200
CHUNK-EXT-CTRL	400 or close	✅TimedOut
CHUNK-EXT-CR	400 or close	✅TimedOut
TE-VTAB	400 or close	✅400
TE-FORMFEED	400 or close	✅400
TE-NULL	400 or close	✅400
CHUNK-LF-TRAILER	400 or 2xx	⚠️200
TE-IDENTITY	400/501 or close	✅400
CHUNK-NEGATIVE	400 or close	✅400
TRANSFER_ENCODING	400 or 2xx	⚠️200
CL-COMMA-SAME	400 or 2xx	✅400
CL-COMMA-TRIPLE	400 or 2xx	✅400
CHUNKED-WITH-PARAMS	400 or 2xx	✅400
EXPECT-100-CL	100, 400 or 2xx	⚠️100
TRAILER-CL	400 or 2xx	❌505
TRAILER-TE	400 or 2xx	❌505
TRAILER-HOST	400 or 2xx	❌505
TRAILER-AUTH	400 or 2xx	❌505
HEAD-CL-BODY	400 or 2xx	⚠️200
OPTIONS-CL-BODY	400/405 or 2xx	⚠️200
CL-UNDERSCORE	400 or close	✅400
CL-NEGATIVE-ZERO	400 or close	✅400
CL-DOUBLE-ZERO	400 or 2xx	⚠️200
CL-LEADING-ZEROS-OCTAL	400 or 2xx	⚠️200
TE-OBS-FOLD	400 or 2xx+close	✅400
TE-TRAILING-COMMA	400 or 2xx	✅400
TE-TAB-BEFORE-VALUE	400 or 2xx	✅400
ABSOLUTE-URI-HOST-MISMATCH	400 or 2xx	❌505
MULTIPLE-HOST-COMMA	400 or close	❌200
CHUNK-BARE-CR-TERM	400 or close	✅TimedOut
TRAILER-CONTENT-TYPE	400 or 2xx	❌505
CLTE-CONN-CLOSE	400, or 2xx + close	✅400
TECL-CONN-CLOSE	400, or 2xx + close	✅400
CLTE-DESYNC	400, or close	✅400
CLTE-SMUGGLED-GET	400, or close (no extra response)	✅400
CLTE-SMUGGLED-GET-CL-PLUS	400, or close (no extra response)	✅400
CLTE-SMUGGLED-GET-CL-NON-NUMERIC	400, or close (no extra response)	✅400
CLTE-SMUGGLED-GET-TE-OBS-FOLD	400, or close (no extra response)	✅400
CLTE-SMUGGLED-HEAD	400, or close (no extra response)	✅400
CLTE-SMUGGLED-GET-TE-TRAILING-SPACE	400, or close (no extra response)	✅400
CLTE-SMUGGLED-GET-TE-LEADING-COMMA	400, or close (no extra response)	✅400
CLTE-SMUGGLED-GET-TE-CASE-MISMATCH	400, or close (no extra response)	✅400
TE-DUPLICATE-HEADERS-SMUGGLED-GET	400, or close (no extra response)	✅400
TECL-SMUGGLED-GET	400, or close (no extra response)	✅400
DUPLICATE-CL-SMUGGLED-GET	400, or close (no extra response)	❌200
GET-CL-PREFIX-DESYNC	400/close preferred; extra response on step 2 = warn	⚠️200
TECL-DESYNC	400, or close	✅400
CL0-BODY-POISON	400/close preferred; poisoned follow-up = warn	⚠️200
GET-CL-BODY-DESYNC	400/close/pass-through; poisoned follow-up = warn	✅200
OPTIONS-CL-BODY-DESYNC	400/close/pass-through; poisoned follow-up = warn	✅200
EXPECT-100-CL-DESYNC	417/400/close preferred; poisoned follow-up = warn	⚠️200
OPTIONS-TE-OBS-FOLD	400, or 2xx + close	✅400
CHUNK-INVALID-SIZE-DESYNC	400, or close	✅400
PIPELINE-SAFE	2xx + 2xx	✅200

Malformed Input

Test	Expected	uWebSockets
BINARY-GARBAGE	400/close/timeout	❌505
LONG-URL	400/414/431 or close	✅431
LONG-HEADER-VALUE	400/431 or close	✅431
MANY-HEADERS	400/431 or close	✅431
NUL-IN-URL	400 or close	❌505
CONTROL-CHARS-HEADER	400 or close	✅400
INCOMPLETE-REQUEST	400/close/timeout	✅TimedOut
EMPTY-REQUEST	400/close/timeout	✅TimedOut
LONG-HEADER-NAME	400/431 or close	✅431
LONG-METHOD	400 or close	❌431
NON-ASCII-HEADER-NAME	400 or close	✅400
NON-ASCII-URL	400 or close	❌200
CL-OVERFLOW	400 or close	✅400
WHITESPACE-ONLY-LINE	400/close/timeout	❌505
NUL-IN-HEADER-VALUE	400 or close	✅400
CHUNK-SIZE-OVERFLOW	400 or close	✅400
H2-PREFACE	400/505/close/timeout	✅505
CL-EMPTY	400 or close	❌200
CL-TAB-BEFORE-VALUE	400 or 2xx	⚠️200
URL-BACKSLASH	400 or 2xx/404	⚠️200
URL-OVERLONG-UTF8	400 or close	❌200
URL-PERCENT-NULL	400 or 2xx/404	⚠️200
URL-PERCENT-CRLF	400 or 2xx/404	⚠️200
CHUNK-EXT-64K	400 or 2xx	✅400
RANGE-OVERLAPPING	200/206/400/416	⚠️200
POST-CL-HUGE-NO-BODY	400/413/close/timeout	✅TimedOut

Header Normalization

Test	Expected	uWebSockets
UNDERSCORE-CL	Reject/drop (pass), normalize (fail), preserve (warn)	⚠️200
SP-BEFORE-COLON-CL	Reject/drop (pass), normalize (fail), preserve (warn)	✅400
TAB-IN-NAME	Reject/drop (pass), normalize (fail), preserve (warn)	✅400
CASE-TE	Reject/drop (pass), normalize casing (fail), preserve (warn)	✅400
UNDERSCORE-TE	Reject/drop (pass), normalize (fail), preserve (warn)	⚠️200

_{Commit: 042301b}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud