🐛Illegal status code can be registered at `http_status`

[kurochan]

Describe the bug

Weak validation of http_status, so incorrect can register http status.

To Reproduce

1. Configure http_status:999

Expected behavior
Only existing http status codes can be registered.

Environment and versions

• OS: All
• Architecture: All
• Version: 2024.12.2

Additional context
After this, I plan to create a PR, but fixing this issue requires modifications not only to cloudflared but also to the Web UI( https://one.dash.cloudflare.com/ ).

[lazysegtree]

Is there a possible security issue due to invalid HTTP status code ?

[lazysegtree]

Also there are some "Unofficial codes" that might be a valid use case (See wiki ), for which go's StatusText function (source) would not return any text.

• For example HTTP 218, 509, 529, and many more

(Here is a screenshot from wiki page about the additional unofficial codes, used by cloudflare too)

See - #1390 (comment)

[lazysegtree]

In my opinion, this should not be done. We should allow any unofficial HTTP code, on any other custom HTTP code a user wants. This doesn't seem to pose any security risk.

[DevinCarr]

As it's within the user's control to set whatever status code response: [100,999], we don't see any issue why this would be a problem, let alone a security risk. We don't want to block users from using undocumented status codes for their web services.