HAL9000
89d8b9e751
fix(lsp): prevent header injection in LSP transport ASCII decoding
...
Security: Added strict ASCII validation to _read_one_message() header parsing
to enforce LSP specification requirements. Non-ASCII bytes in headers now raise
LspError. Printable-ASCII guard rejects characters outside 0x20–0x7E range.
- Removed redundant inline LspError imports from start() exception handlers
(top-level import added instead)
- Updated _read_one_message() docstring with ASCII enforcement documentation
- Created BDD test suite for LSP header injection security scenarios
- Fixed Gherkin feature file tag placement and whitespace
- Fixed select.select() 3-tuple return in patched mock to match API contract
- Cleaned up CHANGELOG.md bullet formatting and CONTRIBUTORS.md entries
Closes #7112
Signed-off-by: HAL9000 <hal9000@cleverthis.com >
2026-06-13 04:39:01 -04:00
HAL9000
54b08e00f2
fix(lsp): address code-review blockers in LSP header injection fix ( #10608 )
...
- Move Gherkin scenario tags from inline to separate lines before Scenario keywords in feature spec
- Remove HAL 9000 prose contribution entry from name list in CONTRIBUTORS.md per project conventions
- Add commit footer: ISSUES CLOSED : #7112
ISSUES CLOSED : #7112
2026-06-13 04:36:34 -04:00
HAL9000
b5b4e740c2
fix(lsp): correct Content-Length in BDD scenario from 46 to 43 bytes
...
Body is exactly 43 bytes long. CL=46 caused _read_one_message to timeout
waiting for 3 extra bytes, returning None instead of valid JSON.
2026-06-13 04:33:37 -04:00
HAL9000
7967220d10
add BDD scenario for LSP transport header injection vulnerability (issue #7112 )
2026-06-13 04:14:26 -04:00
HAL9000