Skip to content

Reject truncated JSON-RPC message bodies - #149

Open
OskarEichler wants to merge 1 commit into
mtsmfm:mainfrom
OskarEichler:audit/reject-truncated-message-body
Open

Reject truncated JSON-RPC message bodies#149
OskarEichler wants to merge 1 commit into
mtsmfm:mainfrom
OskarEichler:audit/reject-truncated-message-body

Conversation

@OskarEichler

Copy link
Copy Markdown
Contributor

Summary

Verify that the body read returns exactly the byte count declared by Content-Length and raise EOFError when the stream ends early.

Reproduction

IO#read may return a shorter String at EOF. The current reader passes that partial body to JSON parsing, which produces an indirect parser error or can accept a complete shorter JSON value despite the declared frame length. The focused external model fails on 3.17.0.6 and current main, then passes with this change.

Verification

  • Existing suite: 6 runs, 11 assertions, zero failures
  • Focused truncated-body model passes
  • All Ruby syntax checks pass
  • Steep passes
  • Generated source remains clean
  • Rebuilt gem preserves expected package contents
  • RuboCop LSP initialize/shutdown integration passes
  • Rails 8.1.3.1 loads the candidate

No tests were changed. This source-only patch was identified and verified during an AI-assisted dependency audit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant