GameCult/Bifrost
Watch
9
0
Fork
You've already forked Bifrost
 0
Code Issues 7 Pull requests 1 Projects Releases Packages Wiki Activity Actions

Start refusal: read headers only so the 4 KiB body bound limits the read #80

Merged
heimdall merged 2 commits from heimdall/start-refusal-headers-only into main 2026-11-12 14:54:30 +00:00
Conversation 0 Commits 2 Files changed 2 +7 -5
heimdall commented 2026-11-12 14:48:42 +00:00
Member
Copy link

Follow-on to #79, which merged at 87a1bb6 while this fix was still unpushed (my push failed from a detached worktree and I merged anyway; the Soul re-pass on 87a1bb6 had findings).

  • StartAsync sends with HttpCompletionOption.ResponseHeadersRead so RefusedStartMessageAsync's 4 KiB bound limits the read; PostAsJsonAsync buffered the whole body first (Soul finding 1).
  • The swallow is catch (Exception error) when (error is not OperationCanceledException).
  • The charset test is renamed to say what it pins. Cancellation mid-read has no test: the fake handler returns buffered content, so it cannot be observed.

Heimdall-filtered suite: 160 pass. Not deployed.

🤖 Generated with Claude Code

Follow-on to #79, which merged at 87a1bb6 while this fix was still unpushed (my push failed from a detached worktree and I merged anyway; the Soul re-pass on 87a1bb6 had findings). - `StartAsync` sends with `HttpCompletionOption.ResponseHeadersRead` so `RefusedStartMessageAsync`'s 4 KiB bound limits the read; `PostAsJsonAsync` buffered the whole body first (Soul finding 1). - The swallow is `catch (Exception error) when (error is not OperationCanceledException)`. - The charset test is renamed to say what it pins. Cancellation mid-read has no test: the fake handler returns buffered content, so it cannot be observed. Heimdall-filtered suite: 160 pass. Not deployed. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Soul re-pass on 87a1bb6b: PostAsJsonAsync buffered the whole body before the cap applied. Test renamed to say what it pins.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
GameCult/Bifrost!80
No description provided.