HTTP client silently drops request headers larger than 4095 bytes
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 72/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- c
- Domain
- backend, networking
Research direction
Read src/net/http/http_client.c around lines 395–407, then trace the request path in cwist_http_client_request() and find the existing loopback HTTP client tests. Add a test that sends a header larger than 4095 bytes and checks that it arrives intact or the request fails explicitly. The issue is done when oversized headers and curl_slist_append() allocation failures are handled without silently performing a changed request.
Written by the indexing model from the issue text.
Description
Affected: dev at bb2a33946.
cwist_http_client_request() formats each request header into a 4096-byte local buffer. When the formatted line does not fit, it simply skips curl_slist_append() and continues (src/net/http/http_client.c:395-407). The request still runs and no error reaches the caller.
Long Authorization, Cookie, or signed headers can therefore disappear silently, producing an unauthenticated or otherwise different request. CWIST's own general header limit is 8 KiB, so the client drops values within a size the framework otherwise accepts.
Expected: allocate each serialized header dynamically or return an explicit error before performing the request. Also check curl_slist_append() failures without losing the existing list. Add a loopback test proving that a header above 4095 bytes arrives intact or fails explicitly.
- Dominant language
- C
- Stars
- 16
- Forks
- 7
- Avg merge
- 4h 28m
- Merged PRs (30d)
- 191
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from c4punks/CWIST
-
enhancement
Difficulty 4/5 3-5 days Newbie friendliness 55/100
Maintainers usually reply within 1 day
-
enhancement good first issue
Difficulty 4/5 3-5 days Newbie friendliness 48/100
Maintainers usually reply within 1 day
-
enhancement good first issue
Difficulty 4/5 3-5 days Newbie friendliness 52/100
Maintainers usually reply within 1 day
-
enhancement
Difficulty 4/5 3-5 days Newbie friendliness 57/100
Maintainers usually reply within 1 day
-
enhancement
Difficulty 4/5 3-5 days Newbie friendliness 48/100
Maintainers usually reply within 1 day
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
kmod-project/kmod#492 ·
Maintainers usually reply within 4 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
PecanProject/sipnet#435 · 1 comment ·
Maintainers usually reply within 2 days
-
SDL_GPU Vulkan: wrong screen orientation on OpenHarmony (preTransform set without pre-rotation)Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
libsdl-org/SDL#16670 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
要トリアージ 辞書
Difficulty 1/5 1-3 hours Newbie friendliness 86/100
yksr-melt/Meltype#1625 · 1 reaction ·
Maintainers usually reply within 1 day