cleveragents/cleveragents-core

fix(lsp): prevent header injection in LSP transport ASCII decoding #10608

Merged

HAL9000 merged 9 commits from bugfix/m3.6.0-lsp-transport-header-injection-ascii into master

2026-06-13 08:57:41 +00:00

Author	SHA1	Message	Date
controller-ci-rerun	3e23d65d1c	chore: re-trigger CI [controller] CI / lint (pull_request) Successful in 39s Details CI / build (pull_request) Successful in 46s Details CI / push-validation (pull_request) Successful in 46s Details CI / quality (pull_request) Successful in 53s Details CI / typecheck (pull_request) Successful in 1m0s Details CI / security (pull_request) Successful in 1m6s Details CI / helm (pull_request) Successful in 1m22s Details CI / unit_tests (pull_request) Successful in 5m54s Details CI / docker (pull_request) Successful in 1m39s Details CI / integration_tests (pull_request) Successful in 10m16s Details CI / coverage (pull_request) Successful in 11m22s Details CI / status-check (pull_request) Successful in 5s Details CI / lint (push) Successful in 35s Details CI / push-validation (push) Successful in 41s Details CI / helm (push) Successful in 53s Details CI / quality (push) Successful in 56s Details CI / build (push) Successful in 1m2s Details CI / e2e_tests (push) Successful in 58s Details CI / typecheck (push) Successful in 1m22s Details CI / security (push) Successful in 1m23s Details CI / unit_tests (push) Successful in 4m55s Details CI / docker (push) Successful in 2m43s Details CI / integration_tests (push) Successful in 8m30s Details CI / coverage (push) Successful in 12m49s Details CI / status-check (push) Successful in 4s Details CI / benchmark-regression (push) Has been cancelled Details CI / benchmark-publish (push) Has been cancelled Details	2026-06-13 04:39:01 -04:00
HAL9000	89d8b9e751	fix(lsp): prevent header injection in LSP transport ASCII decoding Security: Added strict ASCII validation to _read_one_message() header parsing to enforce LSP specification requirements. Non-ASCII bytes in headers now raise LspError. Printable-ASCII guard rejects characters outside 0x20–0x7E range. - Removed redundant inline LspError imports from start() exception handlers (top-level import added instead) - Updated _read_one_message() docstring with ASCII enforcement documentation - Created BDD test suite for LSP header injection security scenarios - Fixed Gherkin feature file tag placement and whitespace - Fixed select.select() 3-tuple return in patched mock to match API contract - Cleaned up CHANGELOG.md bullet formatting and CONTRIBUTORS.md entries Closes #7112 Signed-off-by: HAL9000 <hal9000@cleverthis.com>	2026-06-13 04:39:01 -04:00
HAL9000	54b08e00f2	fix(lsp): address code-review blockers in LSP header injection fix (#10608 ) - Move Gherkin scenario tags from inline to separate lines before Scenario keywords in feature spec - Remove HAL 9000 prose contribution entry from name list in CONTRIBUTORS.md per project conventions - Add commit footer: ISSUES CLOSED: #7112 ISSUES CLOSED: #7112	2026-06-13 04:36:34 -04:00
HAL9000	37c931696d	fix(lsp): apply ruff format to LSP transport and test steps Format two Python files to resolve ci/lint failure from 2054 files already formatted detecting misalignment.	2026-06-13 04:33:37 -04:00
HAL9000	b5b4e740c2	fix(lsp): correct Content-Length in BDD scenario from 46 to 43 bytes Body is exactly 43 bytes long. CL=46 caused _read_one_message to timeout waiting for 3 extra bytes, returning None instead of valid JSON.	2026-06-13 04:33:37 -04:00
HAL9000	1a6f10d5fb	fix(lsp): prevent header injection in LSP transport ASCII decoding Closes #7112 ISSUES CLOSED: #7112 EPIC REFERENCES: #824	2026-06-13 04:33:37 -04:00
HAL9000	bb3495931e	add step definitions for LSP header injection BDD security tests	2026-06-13 04:14:26 -04:00
HAL9000	7967220d10	add BDD scenario for LSP transport header injection vulnerability (issue #7112 )	2026-06-13 04:14:26 -04:00
HAL9000	62a73a5e02	fix(lsp): restore secure ASCII decoding, top-level LspError import, printable-ASCII guard	2026-06-13 04:14:26 -04:00