WIP: v0.19: Fixes and tests for std/net/http #1489

jay · 2026-09-08T02:21:05Z

jay commented

2026-09-08 02:21:05 +00:00

WIP, not ready for review

Warning

LLM-assisted with gpt-6-astra and gerbil-mcp

WIP, not ready for review > [!WARNING] > LLM-assisted with `gpt-6-astra` and `gerbil-mcp`

jay added 5 commits

2026-09-08 02:21:05 +00:00

fix(http): validate shared field syntax f5add528d2

Reject invalid field bytes before output to prevent header injection.
Accept valid optional whitespace and normalize ASCII field-name casing;
count all field-section bytes against the configured limit.

fix(http): validate received message framing fa0dbb29e1

Reject ambiguous and invalid lengths before dispatch, close rejected
connections, and distinguish protocol failures from transport errors.
Honor bodyless and handoff precedence, including HEAD 101 and CONNECT
204, and unfold obsolete response fields without weakening requests.

chore(http): merge current staging f7e1e354da

Reuse the upstream Request-content cleanup fix from #1486 and preserve
the existing HTTP commits and their recorded source identities.

fix(net): validate IPv6 address grammar and decoding e3bb09dc6b

HTTP Host validation needs strict literal parsing. Correct group counts
and dotted tails in the shared parser rather than compensating in HTTP.
Also preserve all bits in three-digit terminal groups.

fix(http): validate server Host authority 53b9e84b21

Validate actual Host field occurrences before framing or dispatch.
Keep URI syntax separate from DNS policy and authority reconstruction;
preserve absolute-target precedence and empty-field fallback.

jay changed title from ~~WIP: v0.19: Port std/net/http to v0.19~~ to WIP: v0.19: Fixes and tests for std/net/http

2026-09-08 02:22:04 +00:00

jay added 4 commits

2026-09-08 04:22:35 +00:00

fix(zlib): honor minimum decoded reads b96b81163c

Continue through compressed segments that produce no output or fail the requested minimum. Returning zero early made stream consumers truncate valid HTTP bodies.

fix(io): close delimited readers through owner 5196725770

Use the public close operation to update shared buffer ownership and closed state. Device-only closure let a later alias close free the buffer again.

fix(io): return buffered bytes once minimum is met 5db0f23d5d

Do not perform another source read merely to fill unused output space after buffered input satisfies the minimum. Keep short positive reads distinct from end of input.

fix(http): complete chunked body decoding 934e3f67d2

Consume extensions, trailers and terminal framing, reject incomplete chunks, and preserve reader ownership. Keep both endpoint decoding and short-read streaming covered by regressions.

jay added 1 commit

2026-09-08 05:39:57 +00:00

fix(http): reject truncated fixed-length bodies fa1f997a59

Use one exact-length Reader on both receivers. Generic I/O delimiters cap reads but allow early EOF, so they cannot enforce HTTP body completion.

vyzo reviewed

2026-09-10 17:22:14 +00:00

vyzo left a comment

Jay this is pretty substantial, is it still wip?

src/std/net/http/common/chunked.ss

					
				@ -86,0 +82,4 @@

				  (when self.reader

				    ;; Draining through read validates framing and avoids passing a potentially

				    ;; 64-bit wire size to BufferedReader.skip's fixnum-only contract.

				    (let (buffer (make-u8vector 4096))

use the buffer-cache from this, :std/io/bio/cache

@vyzo hey yeah as I mentioned in other PR, haven't had time to fully validate this yet
I had the agent get us fully compliant with https://github.com/uNetworking/h1spec
But I haven't done any benchmarking of this yet. I will have more time next week but otherwise you are welcome to take this over or scrap it

@vyzo hey yeah as I mentioned in other PR, haven't had time to fully validate this yet I had the agent get us fully compliant with https://github.com/uNetworking/h1spec But I haven't done any benchmarking of this yet. I will have more time next week but otherwise you are welcome to take this over or scrap it

vyzo commented

2026-09-10 18:40:21 +00:00

yeah, it's ok, we can wait.

This pull request has changes conflicting with the target branch.

src/std/net/http/client/request.ss
src/std/net/http/common/ioutil.ss
src/std/net/http/server/request.ss
src/std/net/http/server/server-test.ss
src/std/net/http/server/server.ss

View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Merge commit title

WIP: v0.19: Fixes and tests for std/net/http (#1489)

Merge commit body

Reviewed-on: https://git.cons.io/mighty-gerbils/gerbil/pulls/1489

WIP: v0.19: Fixes and tests for std/net/http (#1489)

Reviewed-on: https://git.cons.io/mighty-gerbils/gerbil/pulls/1489

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u v0.19-std-net-http:jay-v0.19-std-net-http

git switch jay-v0.19-std-net-http

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch v0.19-staging

git merge --no-ff jay-v0.19-std-net-http

git switch jay-v0.19-std-net-http

git rebase v0.19-staging

git switch v0.19-staging

git merge --ff-only jay-v0.19-std-net-http

git switch jay-v0.19-std-net-http

git rebase v0.19-staging

git switch v0.19-staging

git merge --no-ff jay-v0.19-std-net-http

git switch v0.19-staging

git merge --squash jay-v0.19-std-net-http