Repository navigation
fix: return HTTP 413 for oversized panel requests - #424
Merged
Merged
Conversation
what changed Request-body overflow releases retained chunks and ignores subsequent data/end parsing. The handler sends the existing 413 JSON refusal with Connection: close, so the response flushes before closing the connection rather than destroying the request socket first. why Fixes #324. Destroying the request socket inside readBody prevented the handler's intended error response from reaching the client. This corrects response ordering under the existing byte limit; no new route, flag, format or check is introduced. what it touched research-kit/lib/panel.mjs; two panel regressions for an oversized POST and the exact byte boundary; the panel architecture row; CHANGELOG.md; the registered offline test count in research-kit/README.md (1847). what you verified verified: direct baseline loopback probe produced ECONNRESET for a 16385-byte JSON body, with the next state request returning 200. verified: the fixed probe receives 413, Connection: close and {"error":"the request is too large"}; the next state request returns 200. verified: boundary probe admits a complete 16384-byte JSON body to route handling (404 for the unknown test route), returns the intended 413 for 16385 bytes and 3 MB, then answers state with 200. verified: node research-kit/bin/selftest.mjs panel passed 26 tests, 0 failed, with 2 existing unsupported symlink cases in 5.9s (LOCAL RESEARCH_KIT_ALLOW_UNSUP=1), including both new regressions. verified: handoff OK (33 entries, 27 evidence rows), preflight PASS (28 passing, 1 existing unstamped-brief warning), and git diff --check. Cwd: C:\Users\PC\Desktop\gittoken\Research-Kit-issue-324. verified: doctor today from the issue-296 checkout reports READY on the shared machine, collector role, firecrawl-cli fetch/search. expected: the normal pre-commit gate will run the full staged-tree suite and validate architecture/README before this commit is recorded; exact-head CI will accompany the PR. untested: local symlink creation is unavailable for two existing cases; CI must verify that capability. No external service or real operator panel was used; requests go only to disposable loopback servers with scratch machine state. what you got wrong and fixed nothing to report
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #324.
What changed
Oversized panel API requests now receive the existing JSON HTTP 413 refusal with
Connection: closebefore the connection closes. Body handling releases retained chunks and ignores subsequent request data. The 16 KiB limit is unchanged.Why
Destroying the request socket as soon as the limit was exceeded caused clients to receive a connection reset before the refusal could arrive.
What it touched
Panel request-body handling, two regression tests, architecture documentation, the changelog, and the registered test count.
What you verified
b42ff91, including Windows, both Ubuntu platforms, Node 24/26, archive tree, and the aggregate suite. Node 24: 1847 passed, 0 failed in 195.3s (watchdog 60000ms/test).What you got wrong and fixed
Nothing to report.