- Add BDD test scenarios for header injection vulnerability
- Tests cover non-ASCII bytes in Content-Length, header names, and unknown headers
- Tests verify that LspError is raised for non-ASCII bytes
- Implementation fix pending: change errors='replace' to errors='strict' in _read_one_message()
- Add UnicodeDecodeError handling to raise LspError instead of silently replacing bytes

@@ -7,6 +7,15 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Fixed
 

@@ -0,0 +36,4 @@
+    context.mock_process.stdout = BytesIO(malicious_header)
+
+    try:
+        context.transport.read_message(timeout=1.0)

@@ -0,0 +39,4 @@
+        context.transport.read_message(timeout=1.0)
+    except LspError as e:
+        context.exception = e
+

@@ -0,0 +114,4 @@
+
+@then("the message body is correctly parsed as JSON")
+def step_check_message_json_parsing(context: Context) -> None:
+    """Verify that the message body was correctly parsed as JSON."""

@@ -7,6 +7,15 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Fixed
 

@@ -0,0 +36,4 @@
+    context.mock_process.stdout = BytesIO(malicious_header)
+
+    try:
+        context.transport.read_message(timeout=1.0)

@@ -0,0 +1,32 @@
+@tdd_issue @tdd_issue_7112 Feature: LSP transport header injection vulnerability (issue #7112)

@@ -0,0 +22,4 @@
+# ── Given steps ──────────────────────────────────────────────────────────
+
+
+@given("a Transport mock with BytesIO stream containing {raw_headers:r}")

@@ -0,0 +47,4 @@
+    unblocking ``stdout.readline()`` and driving the header-reading loop with
+    the data already sitting in the ``BytesIO`` buffer.
+    """
+    

@@ -0,0 +48,4 @@
+    the data already sitting in the ``BytesIO`` buffer.
+    """
+    
+    def _patched_select(readable, *_args: Any, timeout: float | None = None) -> list[Any]:

@@ -0,0 +47,4 @@
+    unblocking ``stdout.readline()`` and driving the header-reading loop with
+    the data already sitting in the ``BytesIO`` buffer.
+    """
+    

@@ -0,0 +49,4 @@
+    """
+    
+    def _patched_select(readable, *_args: Any, timeout: float | None = None) -> list[Any]:
+        if readable:

@@ -2,6 +2,7 @@
 
 * Aditya Chhabra <aditya.chhabra@cleverthis.com>
 * Brent E. Edwards <brent.edwards@cleverthis.com>

@@ -0,0 +1,32 @@
+@tdd_issue @tdd_issue_7112 Feature: LSP transport header injection vulnerability (issue #7112)

@@ -0,0 +11,4 @@
+    Then it should raise an LspError exception
+    And the error message must contain "non-ASCII"
+
+@tdd_issue_7112 Scenario: Non-ASCII byte in a valid Content-Length name raises LspError  

@@ -0,0 +22,4 @@
+# ── Given steps ──────────────────────────────────────────────────────────
+
+
+@given("a Transport mock with BytesIO stream containing {raw_headers:r}")

@@ -0,0 +47,4 @@
+    unblocking ``stdout.readline()`` and driving the header-reading loop with
+    the data already sitting in the ``BytesIO`` buffer.
+    """
+    

@@ -0,0 +48,4 @@
+    the data already sitting in the ``BytesIO`` buffer.
+    """
+    
+    def _patched_select(readable, *_args: Any, timeout: float | None = None) -> list[Any]:

@@ -0,0 +1,32 @@
+@tdd_issue @tdd_issue_7112 Feature: LSP transport header injection vulnerability (issue #7112)

@@ -0,0 +22,4 @@
+# ── Given steps ──────────────────────────────────────────────────────────
+
+
+@given("a Transport mock with BytesIO stream containing {raw_headers:r}")

@@ -0,0 +47,4 @@
+    unblocking ``stdout.readline()`` and driving the header-reading loop with
+    the data already sitting in the ``BytesIO`` buffer.
+    """
+    

@@ -0,0 +48,4 @@
+    the data already sitting in the ``BytesIO`` buffer.
+    """
+    
+    def _patched_select(readable, *_args: Any, timeout: float | None = None) -> list[Any]:

@@ -0,0 +62,4 @@
+        context.raised_error = None
+        try:
+            context.read_result = context.transport._read_one_message(timeout=1.0)
+        except Exception as exc: