Skip to content

[quality] add 35 tests for read-capped-body DoS prevention modules (CWE-400)#19756

Open
kubestellar-hive[bot] wants to merge 1 commit into
mainfrom
quality/test-read-capped-body
Open

[quality] add 35 tests for read-capped-body DoS prevention modules (CWE-400)#19756
kubestellar-hive[bot] wants to merge 1 commit into
mainfrom
quality/test-read-capped-body

Conversation

@kubestellar-hive

@kubestellar-hive kubestellar-hive Bot commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

Test Improvement

Adds 35 tests for two security-critical DoS prevention modules at 0% coverage:

read-capped-body.ts (24 tests)

  • isBodyTooLargeError: Error type detection
  • readCappedBodyBuffer: null body, within limit, at boundary, content-length rejection, streaming rejection, multi-chunk, edge cases
  • readCappedBodyText: text decoding, UTF-8 multibyte
  • readCappedBodyJson: parse valid/invalid, size enforcement

readCappedBody.ts (11 tests)

  • BodyTooLargeError class construction
  • Stream-based enforcement (does NOT trust Content-Length)
  • Multibyte character byte counting
  • Chunked delivery mid-stream rejection

Both modules mitigate CWE-400 (Uncontrolled Resource Consumption).

Filed by quality agent (hold-gated mode). Human review required.

Copilot AI review requested due to automatic review settings June 26, 2026 21:48
Copilot AI reviewed Jun 26, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

@kubestellar-prow kubestellar-prow Bot added the dco-signoff: yes Indicates the PR's author has signed the DCO. label Jun 26, 2026
@kubestellar-prow

kubestellar-prow Bot commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign mikespreitzer for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@netlify

netlify Bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for kubestellarconsole ready!

Name Link
🔨 Latest commit 58e7e26
🔍 Latest deploy log https://app.netlify.com/projects/kubestellarconsole/deploys/6a41f6c3eba6b500080d876d
😎 Deploy Preview https://deploy-preview-19756.console-deploy-preview.kubestellar.io
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@kubestellar-hive kubestellar-hive Bot added hold Blocked — do not touch quality testing labels Jun 26, 2026
@github-actions github-actions Bot added the ai-generated Pull request generated by AI label Jun 26, 2026
@github-actions

github-actions Bot commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

👋 Hey @kubestellar-hive[bot] — thanks for opening this PR!

🤖 This project is developed exclusively using AI coding assistants.

Please do not attempt to code anything for this project manually.
All contributions should be authored using an AI coding tool such as:

This ensures consistency in code style, architecture patterns, test coverage,
and commit quality across the entire codebase.

This is an automated message.

@kubestellar-prow kubestellar-prow Bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jun 26, 2026
@kubestellar-hive kubestellar-hive Bot force-pushed the quality/test-read-capped-body branch 9 times, most recently from 78f4a3c to a9f1a5b Compare June 28, 2026 02:12
ZachDreamZ
ZachDreamZ approved these changes Jun 28, 2026
View reviewed changes

@ZachDreamZ ZachDreamZ left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Solid coverage for security-critical modules. Good edge cases: content-length spoofing, multibyte byte counting, mid-stream chunk rejection. Both files are purely additive. LGTM.

@kubestellar-prow

kubestellar-prow Bot commented Jun 28, 2026

Copy link
Copy Markdown
Contributor

@ZachDreamZ: changing LGTM is restricted to collaborators

Details

In response to this:

Solid coverage for security-critical modules. Good edge cases: content-length spoofing, multibyte byte counting, mid-stream chunk rejection. Both files are purely additive. LGTM.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@kubestellar-hive kubestellar-hive Bot force-pushed the quality/test-read-capped-body branch 7 times, most recently from ba67c44 to 152798f Compare June 28, 2026 18:28
@kubestellar-hive kubestellar-hive Bot force-pushed the quality/test-read-capped-body branch 3 times, most recently from 96ca739 to e6e78a8 Compare June 29, 2026 00:36
[quality] add 35 tests for read-capped-body DoS prevention modules (C…
58e7e26 
…WE-400)

Adds comprehensive tests for two previously untested security-critical
modules that enforce request body size limits:

- read-capped-body.ts (24 tests): content-length early rejection,
  streaming byte enforcement, multi-chunk handling, edge cases
- readCappedBody.ts (11 tests): stream-only enforcement, BodyTooLargeError,
  Content-Length header distrust, multibyte character handling

Signed-off-by: Quality Agent <quality-agent@kubestellar.io>
@kubestellar-hive kubestellar-hive Bot force-pushed the quality/test-read-capped-body branch from e6e78a8 to 58e7e26 Compare June 29, 2026 04:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
+1 more reviewer
@ZachDreamZ ZachDreamZ ZachDreamZ approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

ai-generated Pull request generated by AI dco-signoff: yes Indicates the PR's author has signed the DCO. hold Blocked — do not touch quality size/L Denotes a PR that changes 100-499 lines, ignoring generated files. testing tier/1-lightweight

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ZachDreamZ