morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #7071] [Bug] gRPC-web trailer values keep trailing whitespace #4263

New issue

Closed

opened 2026-10-31 00:48:14 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-31 00:48:14 +00:00

Owner

Originally created by @Adolanium on GitHub (Oct 25, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7071

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Process capture or runtime observation

Observed behavior

With protobuf decoding, inspect_web_network_capture reports a gRPC-web trailer grpc-status: 0 (trailing space before CRLF) as the value "0 ", and grpc-message: ok\t as "ok\t".

Reproduction

Ran on Linux (WSL Ubuntu, Node 24.22.1) at upstream/main through the gRPC-web body decoder in a test, with a trailer frame containing grpc-status: 0 \r\ngrpc-message: alpha\tbeta \t\r\n: the values keep their trailing whitespace.

Expected behavior

"0" and "alpha\tbeta"; RFC 9110 section 5.5 excludes leading and trailing whitespace from a field value.

Impact and scope

Trailer values compared or matched by agents (for example grpc-status) differ from the value the server meant.

REA version

6.7.0, revision 8e6a95788

Runtime and platform

Linux (WSL Ubuntu), Node 24.22.1

Target and artifact context

A synthetic gRPC-web trailer frame.

Interface

MCP

Earliest failure stage

Artifact or evidence registration

Relevant output or evidence

Root cause and fix are in #7069, with the regression test.

Typed outcome or recovery expected

No new error.

Analysis or suspected cause

Root cause and fix are in #7069.

Additional context

Fixed by #7069.

Originally created by @Adolanium on GitHub (Oct 25, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7071 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Process capture or runtime observation ### Observed behavior With protobuf decoding, `inspect_web_network_capture` reports a gRPC-web trailer `grpc-status: 0 ` (trailing space before CRLF) as the value `"0 "`, and `grpc-message: ok\t` as `"ok\t"`. ### Reproduction Ran on Linux (WSL Ubuntu, Node 24.22.1) at upstream/main through the gRPC-web body decoder in a test, with a trailer frame containing `grpc-status: 0 \r\ngrpc-message: alpha\tbeta \t\r\n`: the values keep their trailing whitespace. ### Expected behavior `"0"` and `"alpha\tbeta"`; RFC 9110 section 5.5 excludes leading and trailing whitespace from a field value. ### Impact and scope Trailer values compared or matched by agents (for example `grpc-status`) differ from the value the server meant. ### REA version 6.7.0, revision `8e6a95788` ### Runtime and platform Linux (WSL Ubuntu), Node 24.22.1 ### Target and artifact context A synthetic gRPC-web trailer frame. ### Interface MCP ### Earliest failure stage Artifact or evidence registration ### Relevant output or evidence Root cause and fix are in #7069, with the regression test. ### Typed outcome or recovery expected No new error. ### Analysis or suspected cause Root cause and fix are in #7069. ### Additional context Fixed by #7069.

bsakaguchi closed this issue

2026-10-31 00:48:14 +00:00

bsakaguchi commented

2026-10-31 00:48:16 +00:00

Author

Owner

@XinwangTao commented on GitHub (Oct 25, 2026):

RFC 9110 5.5 的 OWS 规则确实要求剔除 field value 首尾空白，同时保留内部空白——报告中 alpha\tbeta 中间那个 \t 必须保留，这个区分点正是修复的关键，认可 #7069 只剔除首尾的方向。对 agent 消费方来说 grpc-status 被当成 "0 " 字符串去匹配确实很容易踩坑。一个延伸建议：header 解析路径如果有同样的 field value 读取逻辑，建议一并走 OWS trim 保持一致；另外 grpc-status / grpc-message 这类语义固定的 trailer 可以考虑在解码层直接映射为结构化字段（数字状态码），从根上消除字符串比较的脆弱性。

@XinwangTao commented on GitHub (Oct 25, 2026): RFC 9110 5.5 的 OWS 规则确实要求剔除 field value 首尾空白，同时保留内部空白——报告中 alpha\tbeta 中间那个 \t 必须保留，这个区分点正是修复的关键，认可 #7069 只剔除首尾的方向。对 agent 消费方来说 grpc-status 被当成 "0 " 字符串去匹配确实很容易踩坑。一个延伸建议：header 解析路径如果有同样的 field value 读取逻辑，建议一并走 OWS trim 保持一致；另外 grpc-status / grpc-message 这类语义固定的 trailer 可以考虑在解码层直接映射为结构化字段（数字状态码），从根上消除字符串比较的脆弱性。

bsakaguchi commented

2026-10-31 00:48:16 +00:00

Author

Owner

@Adolanium commented on GitHub (Oct 25, 2026):

Thanks. #7069 stays limited to the gRPC-web trailer parser: internal whitespace such as the \t in alpha\tbeta is kept, only the surrounding SP/HTAB is excluded. Other header paths read their values through different producers, so checking them for the same rule would be a separate change. Mapping grpc-status to a structured numeric field would change the output schema, which is beyond this fix.

@Adolanium commented on GitHub (Oct 25, 2026): Thanks. #7069 stays limited to the gRPC-web trailer parser: internal whitespace such as the `\t` in `alpha\tbeta` is kept, only the surrounding SP/HTAB is excluded. Other header paths read their values through different producers, so checking them for the same rule would be a separate change. Mapping `grpc-status` to a structured numeric field would change the output schema, which is beyond this fix.

bsakaguchi referenced this issue

2026-10-31 01:12:12 +00:00

[PR #4263] [CLOSED] fix(analysis-view): preserve native relationship coverage #6145

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4263

No description provided.

Rows
Columns