cleveragents/cleveragents-core
4
0
Fork 3
Code Issues 6.0k Pull Requests 115 Actions Packages Projects Releases Wiki Activity

fix(lsp): address code-review blockers in LSP header injection fix (#10608)

Browse Source 
- Move Gherkin scenario tags from inline to separate lines before Scenario keywords in feature spec
- Remove HAL 9000 prose contribution entry from name list in CONTRIBUTORS.md per project conventions
- Add commit footer: ISSUES CLOSED: #7112

ISSUES CLOSED: #7112
This commit is contained in:
HAL 9000
2026-05-16 16:24:15 +00:00
committed by drew
parent 37c931696d
commit 54b08e00f2
2 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
features/lsp_header_injection_security.feature
+8 -4
View File
@@ -7,25 +7,29 @@ Feature: LSP transport header injection vulnerability (issue #7112)
old ``errors="replace"`` path could be used to manipulate message
boundaries and desynchronise the protocol.
@tdd_issue_7112 Scenario: Non-ASCII byte in Content-Length value raises LspError
@tdd_issue_7112
Scenario: Non-ASCII byte in Content-Length value raises LspError
Given a Transport mock with BytesIO stream containing b"Content-Length: 10\xc0\r\n\r\nhello\x00world"
When _read_one_message() is invoked
Then it should raise an LspError exception
And the error message must contain "non-ASCII"
@tdd_issue_7112 Scenario: Non-ASCII byte in a valid Content-Length name raises LspError
@tdd_issue_7112
Scenario: Non-ASCII byte in a valid Content-Length name raises LspError
Given a Transport mock with BytesIO stream containing b"Content-Length\xef\x08: 99\r\n\r\n{\"jsonrpc\":\"2.0\"}"
When _read_one_message() is invoked
Then it should raise an LspError exception
And the error message must contain "non-ASCII"
@tdd_issue_7112 Scenario: Non-ASCII byte in an unrecognized header raises LspError
@tdd_issue_7112
Scenario: Non-ASCII byte in an unrecognized header raises LspError
Given a Transport mock with BytesIO stream containing b"Cache-Control\xef\x08: no-cache\r\nContent-Length: 5\r\n\r\n{\"id\":1}"
When _read_one_message() is invoked
Then it should raise an LspError exception
And the error message must contain "non-ASCII"
@tdd_issue_7112 Scenario: Valid ASCII headers are processed correctly
@tdd_issue_7112
Scenario: Valid ASCII headers are processed correctly
Given a Transport mock with BytesIO stream containing b"Content-Length: 43\r\n\r\n{\"jsonrpc\":\"2.0\",\"id\":1,\"result\":\"success\"}"
When _read_one_message() is invoked
Then it should return a parsed JSON dict