fix(lsp): prevent header injection in LSP transport ASCII decoding #11100

Closed
HAL9000 wants to merge 2 commits from bugfix/10608-lsp-header-injection into master

2 Commits

Author SHA1 Message Date
CleverAgents Bot b24880db2e ci: stop master workflow on PR updates
CI / lint (pull_request) Failing after 42s
CI / typecheck (pull_request) Successful in 1m0s
CI / quality (pull_request) Successful in 49s
CI / security (pull_request) Successful in 1m13s
CI / helm (pull_request) Successful in 28s
CI / push-validation (pull_request) Successful in 25s
CI / build (pull_request) Successful in 41s
CI / unit_tests (pull_request) Failing after 1m51s
CI / coverage (pull_request) Has been skipped
CI / docker (pull_request) Has been skipped
CI / integration_tests (pull_request) Failing after 4m12s
CI / e2e_tests (pull_request) Successful in 4m28s
CI / status-check (pull_request) Failing after 3s
Remove the stale pull_request trigger from master.yml so PR branch commits do not launch the master workflow.

Maintenance patch for PR #11100.
2026-06-10 20:18:14 -04:00
HAL9000 4bc1c8f628 fix(lsp): prevent header injection in LSP transport ASCII decoding (#10608)
CI / benchmark-publish (pull_request) Has been skipped
CI / build (pull_request) Successful in 1m1s
CI / helm (pull_request) Successful in 46s
CI / lint (pull_request) Failing after 1m7s
CI / benchmark-regression (pull_request) Failing after 1m14s
CI / push-validation (pull_request) Successful in 33s
CI / quality (pull_request) Successful in 1m23s
CI / typecheck (pull_request) Successful in 1m39s
CI / security (pull_request) Successful in 1m39s
CI / unit_tests (pull_request) Failing after 2m28s
CI / coverage (pull_request) Has been skipped
CI / docker (pull_request) Has been skipped
CI / e2e_tests (pull_request) Successful in 4m6s
CI / integration_tests (pull_request) Successful in 4m23s
CI / status-check (pull_request) Failing after 3s
Replace lenient decode("ascii", errors="replace") with strict
decode("ascii") that raises UnicodeDecodeError on non-ASCII bytes.
Add Content-Length validation (must be positive int in [1, _MAX]),
ASCII-alphanumeric header name pattern validation, and reject headers
with spaces/special chars in names to prevent injection attacks.

ISSUES CLOSED: #10608
2026-05-09 13:33:50 +00:00