fix(input): parse raw request line and headers by name, not position

[dogancanbakir]

Fixes #7626

ParseRawRequest read the request line and headers positionally: line 2 was always taken as the Host line, and header values were read by skipping one byte past the colon.

• headers are parsed uniformly and Host is picked up by name, wherever it sits
• values are trimmed instead of assuming exactly one space, so Host:example.com no longer loses a character and X-Empty: no longer panics the scan
• an absolute request target, as used by proxy captures, now replaces the authority instead of being appended to it

pkg/protocols/http/raw.readRawRequest already handles all of this for template raw: requests.

Tests cover each shape. Well-formed requests parse exactly as before, and the full integration suite is green.

Summary by CodeRabbit

• Bug Fixes

  • Improved HTTP request parsing for absolute and relative request targets.
  • Host information is now handled correctly regardless of header position or capitalization.
  • Improved support for headers without spaces and valueless headers.
  • Malformed headers are now rejected with validation.

• Tests

  • Added coverage for request targets, header variations, and malformed input.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7df6fe7e-2b17-439f-b4bf-d22cd4a099b2

📥 Commits

Reviewing files that changed from the base of the PR and between 49f1d49 and 3796875.

📒 Files selected for processing (2)

• pkg/input/types/http.go
• pkg/input/types/http_test.go

🚧 Files skipped from review as they are similar to previous changes (1)

• pkg/input/types/http.go

---

Walkthrough

ParseRawRequest now parses absolute-form and origin-form targets, resolves Host by header name, validates header syntax, trims values, and preserves non-Host headers. Tests cover valid and malformed request variations.

Changes

Raw HTTP parsing

Layer / File(s)	Summary
Request target and header parsing pkg/input/types/http.go	ParseRawRequest distinguishes absolute and origin-form targets. It uses Host as URL authority when needed, preserves absolute-target authority, validates delimiters and keys, trims values, and excludes Host from the header map.
Parsing behavior validation pkg/input/types/http_test.go	Tests cover Host placement and casing, missing spaces, empty values, absolute-target precedence, origin-form targets, and malformed headers.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• projectdiscovery/nuclei#7525: Both changes modify ParseRawRequest and its tests, but this PR addresses request targets and headers while that PR addresses body newline trimming.

Suggested reviewers: mzack9999, dps0340

Poem

A rabbit parsed each header line,
And kept the Host in proper design.
Absolute paths stayed whole and bright,
Empty values caused no fright.
Tests now guard the request’s flight.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: parsing raw request lines and headers by name instead of position.
Linked Issues check	✅ Passed	The implementation addresses all requirements in #7626, including named Host parsing, trimmed values, valueless headers, and absolute targets.
Out of Scope Changes check	✅ Passed	The code and tests remain within the linked issue scope for correcting ParseRawRequest behavior.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 7626-raw-request-parsing

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/input/types/http.go`:
- Around line 243-250: Normalize the HTTP or HTTPS scheme to lowercase in the
absolute-form branch before calling ParseAbsoluteURL, while preserving the rest
of the request target unchanged; use the existing case-insensitive scheme
detection around urlx parsing. Add a regression test for an uppercase-scheme
target that verifies both the parsed authority and path.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c3181448-9729-44de-96f4-d3395fa4c105

📥 Commits

Reviewing files that changed from the base of the PR and between ba05210 and 49f1d49.

📒 Files selected for processing (2)

• pkg/input/types/http.go
• pkg/input/types/http_test.go