[GH-ISSUE #1738] fix(browser): account for source-map redirect error expansion #583

New issue

Closed

opened 2026-10-15 18:26:24 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:26:24 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 11, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1738

Malformed source-map redirect Location errors include the full declaration and Location strings in each limitation, but admission reserves only 512 characters per failure. An actual HTTP response can carry a larger Location, and JSON escaping further expands the retained error. Multiple failures can therefore exceed the 32 MiB source-map public representation budget.

Reproduced against freshly compiled source unchanged from main e36c82becdd613787bcc59903f8b5fe14eb2f105: a local real HTTP server returned 302 with a 6,008-byte malformed Location (http://[ followed by repeated backslash/quote pairs). fetchWebSourceMaps with 1,500 requests and the explicit approved local origin completed all 1,500 real HTTP requests. It returned 36,555,068 serialized UTF-8 bytes, exceeding 33,554,432 bytes. Each first error message itself occupied 12,108 UTF-8 bytes before the result JSON escaping.

This is an actual HTTP fetch/parser/collection reproduction, without browser simulation or live CDP capture. The source-map declaration, invalid Location and full result are preserved in compact local proof. No credentials or sensitive data were used.

Expected: account for the real escaped error representation before retaining a failure item. Preserve the observed message when it fits; if it cannot fit, report the actual bounded output failure rather than emitting an oversized result or silently truncating URL facts.

Producing owner: WebSourceMapFetcher reserves SOURCE_MAP_FAILURE_LIMITATION_RESERVE for limitation, while SourceMapRedirectLocationError includes unbounded-by-512 URL text. Failure accounting must reconcile the actual field, including JSON expansion, against the reserved envelope. Preserve HTTP-body cleanup and caller cancellation.

Found while implementing #1729. No matching existing report or open PR found. Related resource/token maintenance #1065.

Originally created by @N0zoM1z0 on GitHub (Oct 11, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1738 Malformed source-map redirect Location errors include the full declaration and Location strings in each `limitation`, but admission reserves only 512 characters per failure. An actual HTTP response can carry a larger Location, and JSON escaping further expands the retained error. Multiple failures can therefore exceed the 32 MiB source-map public representation budget. Reproduced against freshly compiled source unchanged from main `e36c82becdd613787bcc59903f8b5fe14eb2f105`: a local real HTTP server returned 302 with a 6,008-byte malformed Location (`http://[` followed by repeated backslash/quote pairs). `fetchWebSourceMaps` with 1,500 requests and the explicit approved local origin completed all 1,500 real HTTP requests. It returned **36,555,068 serialized UTF-8 bytes**, exceeding **33,554,432 bytes**. Each first error message itself occupied 12,108 UTF-8 bytes before the result JSON escaping. This is an actual HTTP fetch/parser/collection reproduction, without browser simulation or live CDP capture. The source-map declaration, invalid Location and full result are preserved in compact local proof. No credentials or sensitive data were used. Expected: account for the real escaped error representation before retaining a failure item. Preserve the observed message when it fits; if it cannot fit, report the actual bounded output failure rather than emitting an oversized result or silently truncating URL facts. Producing owner: `WebSourceMapFetcher` reserves `SOURCE_MAP_FAILURE_LIMITATION_RESERVE` for `limitation`, while `SourceMapRedirectLocationError` includes unbounded-by-512 URL text. Failure accounting must reconcile the actual field, including JSON expansion, against the reserved envelope. Preserve HTTP-body cleanup and caller cancellation. Found while implementing #1729. No matching existing report or open PR found. Related resource/token maintenance #1065.

bsakaguchi

2026-10-15 18:26:24 +00:00