[PR #5422] [CLOSED] fix(protobuf): reject control characters in gRPC-web trailer values #6924

New issue

Closed

opened 2026-11-01 21:44:05 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:44:05 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/5422
Author: @iamdgarcia
Created: 10/20/2026
Status: ❌ Closed

Base: main ← Head: fix/grpc-trailer-chars

📝 Commits (1)

fa268ea fix(protobuf): reject HTTP-forbidden control characters in gRPC-web trailer values

📊 Changes

2 files changed (+56 additions, -2 deletions)

View changed files

📝 src/browser/history/protobuf/ProtobufBody.ts (+16 -2)
📝 src/browser/history/protobuf/ProtobufWire.test.ts (+40 -0)

📄 Description

Trailer parsing in ProtobufBody.ts validated header names but accepted any field value, so a trailer like x-note: ab decoded cleanly and the frame was reported as complete with every byte counted as examined. Reported in #5386 with a minimal HAR repro.

RFC 9110 section 5.5 excludes control characters (0x00-0x08, 0x0A-0x1F, 0x7F) from field values; bare CR and LF are line breaks and cannot appear inside a value split on CRLF anyway.

Fix: a trailer line whose value contains one of those code points now throws the existing malformed-header error, which routes the frame through the existing partial-result path (status: "partial", Invalid gRPC-web trailer header block). Retained body bytes, previously decoded protobuf fields, previously valid trailers, framing, UTF-8 and redaction behavior are unchanged. SP/HTAB handling and empty values are unchanged.

Regression test in ProtobufWire.test.ts covers all five malformed values from the issue plus the control case (SP/HTAB and empty values still accepted, data frame before the trailer still complete).

Validation: vitest 16/16 in the touched suite, tsc --noEmit clean, oxfmt --check clean, oxlint warnings unchanged from baseline (6).

Note: #5386 mentions a fork implementation (xu91102/rea:codex/grpc-web-trailer-values) whose PR could not be created for permission reasons; this is an independent minimal implementation from the issue description, happy to fold either one.

Fixes #5386

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/5422 **Author:** [@iamdgarcia](https://github.com/iamdgarcia) **Created:** 10/20/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/grpc-trailer-chars` --- ### 📝 Commits (1) - [`fa268ea`](https://github.com/morluto/rea/commit/fa268ea13ea738084b86d180a9d7a064673f2f8e) fix(protobuf): reject HTTP-forbidden control characters in gRPC-web trailer values ### 📊 Changes **2 files changed** (+56 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `src/browser/history/protobuf/ProtobufBody.ts` (+16 -2) 📝 `src/browser/history/protobuf/ProtobufWire.test.ts` (+40 -0) </details> ### 📄 Description Trailer parsing in `ProtobufBody.ts` validated header names but accepted any field value, so a trailer like `x-note: ab ` decoded cleanly and the frame was reported as `complete` with every byte counted as examined. Reported in #5386 with a minimal HAR repro. RFC 9110 section 5.5 excludes control characters (0x00-0x08, 0x0A-0x1F, 0x7F) from field values; bare CR and LF are line breaks and cannot appear inside a value split on CRLF anyway. Fix: a trailer line whose value contains one of those code points now throws the existing malformed-header error, which routes the frame through the existing partial-result path (`status: "partial"`, `Invalid gRPC-web trailer header block`). Retained body bytes, previously decoded protobuf fields, previously valid trailers, framing, UTF-8 and redaction behavior are unchanged. SP/HTAB handling and empty values are unchanged. Regression test in `ProtobufWire.test.ts` covers all five malformed values from the issue plus the control case (SP/HTAB and empty values still accepted, data frame before the trailer still complete). Validation: vitest 16/16 in the touched suite, tsc --noEmit clean, oxfmt --check clean, oxlint warnings unchanged from baseline (6). Note: #5386 mentions a fork implementation (`xu91102/rea:codex/grpc-web-trailer-values`) whose PR could not be created for permission reasons; this is an independent minimal implementation from the issue description, happy to fold either one. Fixes #5386 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-01 21:44:05 +00:00