Reflected request fields are served without cache and MIME-sniffing hardening

This file is a small example HTTP server built on `fasthttp`. The remote attacker controls the incoming HTTP request: method, URI, query string, host header, user-agent, connection metadata, and the request body. The handler does not use request data in any dangerous computation, path, SQL, command, or memory-manipulation path. It mainly formats request fields into the response.

The main security concerns are availability and response-handling issues:

1. **Unbounded request reflection / resource exhaustion**:  
   `requestHandler` writes `&ctx.Request` with `%s`. In `fasthttp`, this invokes the `Request.String()` representation, which can include the full request body. The server is started with `fasthttp.ListenAndServe` without configuring explicit bounds such as `MaxRequestBodySize`, `ReadTimeout`, `WriteTimeout`, `IdleTimeout`, or connection limits. A remote client can therefore send a very large or slow request and cause the server to allocate, process, and respond with an equally large payload. If `-compress` is enabled, `fasthttp.CompressHandler` can add additional CPU/buffering pressure.

2. **Missing server-level resource limits**:  
   `main` uses the default `fasthttp` server configuration. Without explicit timeouts and limits, an attacker can tie up goroutines, hold connections open, or exhaust memory through slow or oversized requests.

3. **Reflected request data without cache/MIME-sniffing hardening**:  
   The response echoes many attacker-controlled fields and the raw request. Although the content type is set to `text/plain`, the response does not set `X-Content-Type-Options: nosniff` or `Cache-Control: no-store`/`Vary`. This is low severity here, but it could matter in deployments with legacy clients or shared HTTP caches, because requester-specific fields such as `User-Agent`, `RemoteIP`, or raw request contents could be misinterpreted or cached/replayed.

```json
[
  {
    "severity": "high",
    "title": "Unbounded reflection of attacker-controlled request data enables denial of service",
    "function": "requestHandler",
    "description": "The handler prints &ctx.Request with %s, causing fasthttp.Request.String() to serialize the entire request, including the attacker-controlled body. The server is started without an explicit fasthttp MaxRequestBodySize or other body-size bound, so a remote client can send a very large request and force the server to allocate, process, and write a response of comparable size. If -compress is enabled, fasthttp.CompressHandler adds compression CPU/buffering overhead. This can lead to memory exhaustion and denial of service."
  },
  {
    "severity": "medium",
    "title": "Default fasthttp server is used without timeouts, body-size, or concurrency limits",
    "function": "main",
    "description": "fasthttp.ListenAndServe(*addr, h) relies on default Server settings. The code does not configure ReadTimeout, WriteTimeout, IdleTimeout, MaxRequestBodySize, MaxConnsPerIP, or similar bounds. Remote attackers can send slow requests or open many connections to tie up goroutines and resources, resulting in availability impact."
  },
  {
    "severity": "low",
    "title": "Reflected request fields are served without cache and MIME-sniffing hardening",
    "function": "requestHandler",
    "description": "The response echoes Method, RequestURI, Path, Host, QueryArgs, UserAgent, RemoteIP, and the raw request. Content-Type is text/plain, but the handler does not set X-Content-Type-Options: nosniff or Cache-Control: no-store / Vary. A legacy client could MIME-sniff reflected content, and an intermediate HTTP cache could store and replay a personalized response, potentially leaking requester-specific data such as User-Agent, RemoteIP, or raw request headers/body."
  }
]
```