Repository navigation
根治 HTTP 响应头自由文本注入（raw 导出 502 事故） - #210
Merged
Merged
Conversation
added 3 commits
October 9, 2026 16:59
Agent-Executor: agy Agent-Model: gemini-3.8-flash-high Agent-Effort: unknown Dispatch-Id: dlg-20261009-084646-4733c7 Task-Id: VideoTranscriptAPI-20261009-19
Agent-Executor: agy Agent-Model: gemini-3.8-flash-high Agent-Effort: unknown Dispatch-Id: dlg-20261009-084646-4733c7 Task-Id: VideoTranscriptAPI-20261009-19
Agent-Executor: agy Agent-Model: gemini-3.8-flash-high Agent-Effort: unknown Dispatch-Id: dlg-20261009-084646-4733c7 Task-Id: VideoTranscriptAPI-20261009-19
This was referenced Oct 9, 2026
Required Gate v2 — 状态面板当前状态：pass · 可合并 当前裁决： PR 累计主审轮（影子）： Gate 历史（v1；来源为持久化
|
| Run | Attempt | Head | 状态 | PR 累计主审轮（影子） | 收件人动作 |
|---|---|---|---|---|---|
| 37913280328 | 1 | c940542 |
fail |
— |
要修代码 |
| 37913280328 | 2 | c940542 |
fail |
— |
要修代码 |
| 37921290277 | 1 | cb3c2e0 |
pass |
2/5 · collecting |
可合并 |
历史行按 run_id + run_attempt 去重并只增不删；删除本评论后可由 gate_terminal 制品重建。
zj1123581321
added a commit
that referenced
this pull request
Oct 9, 2026
…robe 容量探针就绪等待由 sleep 改为轮询（解开 #210 quality 红）
zj1123581321
added a commit
that referenced
this pull request
Oct 15, 2026
…robe 容量探针就绪等待由 sleep 改为轮询（解开 #210 quality 红）
zj1123581321
added a commit
that referenced
this pull request
Oct 15, 2026
根治 HTTP 响应头自由文本注入（raw 导出 502 事故）
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
根治 HTTP 响应头自由文本注入（502 事故修复）
现象与根因
GET /view/<token>?raw=calibrated经 Cloudflare 返回 502（error code: 502，cloudflared 隧道报错），无 query 的页面正常。n305 源站直打复现Empty reply from server；uvicorn 日志为h11._util.LocalProtocolError: Illegal header value b"here's how i shipped 2,500 PRs...\n\n..."。根因：
_safe_header_value()只处理字符集维度（非 ASCII →quote()），纯 ASCII 值中的\r\n\t与首尾空白原样进入X-Document-Title等响应头；h11 在响应发送阶段拒绝，连接复位。此时 handler 已记 200，边缘只见 502，无本侧告警（命中 risk-tier personal 档 P1「静默出错」）。修法（输出端上下文编码，双顾问会诊定稿）
_safe_header_value()重写：值完全为可打印 ASCII（\x20-\x7E）、首尾非空格/Tab、不含%时原样输出；否则整体 UTF-8 百分号编码；编码后上限 512 字节，按字符边界截断、剥尾随空白（二分搜索最大前缀）_build_text_metadata_header()Title 行折叠\r\n\t为单空格（同一 title 同一请求，raw 导出面向外部 AI fetcher，front matter 必须同卡修）view_token打真实值前 20 位（原来恒unknown，取证误导）docs/guides/api/quickstart.md元数据头描述与实现对齐（原「RFC 5987」表述与裸quote()实现不符）锁定决策（双顾问会诊 vta-header-inject-rootfix-261009）
utils/（三入口已共用_build_metadata_headers，无第二消费者证据）ebd27a82有意添加，消费方为外部 AI fetcher）验证证据
tests/unit/test_header_value_encoding.py：9 组对抗样本 × 三入口真调用，h11.Response构造判定 + 512 上限 + 行纪律断言；独立红验抽查：仅还原_safe_header_value旧实现，test_three_entrypoints_contract[line1\n\nline2]（生产同款样本）等以LocalProtocolError精准转红make test全量退出码 0（100% 到顶）reviewed_fallback，0 findings699689b8与 HEAD 在缺陷函数区间零差异，根因对线上成立风险与后续
Refs: 会诊任务 vta-header-inject-rootfix-261009（codex=降级→条件全吸收，opus=继续）