`NIOHTTPServer` does not enforce response body framing against `Content-Length`

[0xTim]

This was picked up by some tests in Vapor. ResponseSender.Writer accepts any number of body bytes regardless of the Content-Length the handler declared on the response. finish(buffer:finalElement:) just completes the response without checking, resulting in the potential for under-writing and over-writing with no errors raised in the handler. Under-writing is annoying, over-writing is problem with keep-alive connections as it was treat the additional data as the start of the next response.

Repro

struct ShortBodyHandler: HTTPServerRequestHandler {
    typealias RequestContext = NIOHTTPServer.RequestContext
    typealias Reader = NIOHTTPServer.Reader
    typealias ResponseSender = NIOHTTPServer.ResponseSender

    static let payload = "a"   // or "abcdefgh"

    func handle(
        request: HTTPRequest,
        requestContext: consuming NIOHTTPServer.RequestContext,
        reader: consuming sending NIOHTTPServer.Reader,
        responseSender: consuming sending NIOHTTPServer.ResponseSender
    ) async throws {
        var fields = HTTPFields()
        // Limit the content length to 2 which we'd expect to cause issues with over or under writing.
        fields[.contentLength] = "2"
        var writer = try await responseSender.send(HTTPResponse(status: .ok, headerFields: fields))
        var body = UniqueArray<UInt8>()
        body.append(copying: Array(Self.payload.utf8)[...])
        try await writer.write(buffer: &body)
        try await writer.finish(trailer: nil) // ...and declare the body complete
    }
}

Actual

Both responses return successfully with no error:

payload = "a"         ->  "HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\na"
payload = "abcdefgh"  ->  "HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nabcdefgh"

In the over-write case six bytes follow the declared body.

Expected

write(buffer:) should fail once the accumulated body would exceed the declared Content-Length and finish(buffer:finalElement:) should fail if fewer bytes were written than expected, aborting the response rather than completing it

Impact

In Vapor (where Content-Length is set but the caller on streaming response bodies) an under-writing handler produced a response that AsyncHTTPClient timed out on:

threw after 30.008566208 seconds: stream ended at an unexpected time

This is correct but should error way quicker. I added a guard in Vapor so this fails pretty instantly but it feels like this should be the server's responsibility rather than every implementation having to implement it. There's no workaround for the over-write case