morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #3994] [CLOSED] fix: exclude credential header values from header allocation budget preflight #5980

New issue

Closed

opened 2026-10-31 01:10:54 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:10:54 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/3994
Author: @Sravan1011
Created: 10/15/2026
Status: ❌ Closed

Base: main ← Head: fix/credential-header-budget-preflight

📝 Commits (1)

a0c7e5b fix: exclude credential header values from header allocation budget preflight

📊 Changes

2 files changed (+64 additions, -1 deletions)

View changed files

📝 src/browser/network/PlaywrightNetworkContent.ts (+9 -1)
📝 src/browser/network/PlaywrightScenarioNetwork.test.ts (+55 -0)

📄 Description

Fixes: #3959

Problem

The header allocation budget preflight in captureNetworkHeaders charged the full raw value length of every header against the limit — including credential headers (Cookie, Authorization, Set-Cookie, Proxy-Authorization) — even though those values are always replaced with null in the retained output and contribute zero retained bytes.

A 2000-character Cookie alongside an ordinary X-Ordinary: keep-me header at a 4096-byte budget would return state: "unavailable" and make the capture incomplete, even though the actual retained output (null + "keep-me") fits easily within the budget.

Fix

In the preflight loop, credential headers now use retainedValueLength = 0 in the cost calculation, exactly matching what is retained in output. The name is still charged. Ordinary header values continue to be charged at their full length, so genuinely oversized ordinary header sets still respect the limit.

diff

cost += secrets.redactionAllocationCost(name.length + value.length) + 128;

const isCredential = credentialHeaders.has(name.toLowerCase());
const retainedValueLength = isCredential ? 0 : value.length;
cost += secrets.redactionAllocationCost(name.length + retainedValueLength) + 128;
Tests added

✅ does not charge credential header value length against the header allocation budget — a 2000-char Cookie + ordinary header at 4096-byte budget now returns state: "captured" with Cookie: null/redacted and X-Ordinary: "keep-me"
✅ still rejects a header set where ordinary retained values alone exceed the budget — a 2000-char ordinary header at a 256-byte budget still returns state: "unavailable"
Verification: 27/27 tests pass, typecheck and lint clean.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/3994 **Author:** [@Sravan1011](https://github.com/Sravan1011) **Created:** 10/15/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/credential-header-budget-preflight` --- ### 📝 Commits (1) - [`a0c7e5b`](https://github.com/morluto/rea/commit/a0c7e5b49e0333e4f4ed95ace5bc2d10b73f01ac) fix: exclude credential header values from header allocation budget preflight ### 📊 Changes **2 files changed** (+64 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `src/browser/network/PlaywrightNetworkContent.ts` (+9 -1) 📝 `src/browser/network/PlaywrightScenarioNetwork.test.ts` (+55 -0) </details> ### 📄 Description Fixes: #3959 Problem The header allocation budget preflight in captureNetworkHeaders charged the full raw value length of every header against the limit — including credential headers (Cookie, Authorization, Set-Cookie, Proxy-Authorization) — even though those values are always replaced with null in the retained output and contribute zero retained bytes. A 2000-character Cookie alongside an ordinary X-Ordinary: keep-me header at a 4096-byte budget would return state: "unavailable" and make the capture incomplete, even though the actual retained output (null + "keep-me") fits easily within the budget. Fix In the preflight loop, credential headers now use retainedValueLength = 0 in the cost calculation, exactly matching what is retained in output. The name is still charged. Ordinary header values continue to be charged at their full length, so genuinely oversized ordinary header sets still respect the limit. diff - cost += secrets.redactionAllocationCost(name.length + value.length) + 128; + const isCredential = credentialHeaders.has(name.toLowerCase()); + const retainedValueLength = isCredential ? 0 : value.length; + cost += secrets.redactionAllocationCost(name.length + retainedValueLength) + 128; Tests added ✅ does not charge credential header value length against the header allocation budget — a 2000-char Cookie + ordinary header at 4096-byte budget now returns state: "captured" with Cookie: null/redacted and X-Ordinary: "keep-me" ✅ still rejects a header set where ordinary retained values alone exceed the budget — a 2000-char ordinary header at a 256-byte budget still returns state: "unavailable" Verification: 27/27 tests pass, typecheck and lint clean. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:10:54 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:46:26 +00:00

[PR #6269] [MERGED] fix(kuna): name the rejected address in list_strings input errors #7243

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5980

No description provided.

Rows
Columns