Add bounded Sec-Required-Document-Policy request metadata - #949
Conversation
codeon:
version: 1
authority: FWN-371
description: |-
Reuse the Document-Policy Structured Fields dictionary parser for Sec-Required-Document-Policy with distinct types and errors. Wire client pre-I/O validation, server request accessors with raw preservation, facade exports, docs, and HTTP/1.1 round-trip coverage without enforcement or Document-Policy comparison.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1517df6182
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| .map(|header| header.value().clone()) | ||
| .collect(); | ||
| values.push(value.as_ref().to_string()); | ||
| let policy = SecRequiredDocumentPolicy::parse_values(values.iter().map(String::as_str)) |
There was a problem hiding this comment.
When this helper combines two valid values whose raw lengths total exactly 64 KiB, parse_values accepts them because the shared parser counts only the input bytes, but header_value() inserts ", " between fields and the resulting single emitted header exceeds the advertised 64 KiB per-field bound. The client can therefore emit a value that SecRequiredDocumentPolicy::parse and the server accessor reject when received as one field; account for separator overhead or validate the canonical value before replacing the headers.
Useful? React with 👍 / 👎.
1 participant
Summary
SecRequiredDocumentPolicyprotocol types that reuse the Document-Policy Structured Fields dictionary parser with distinct errors and the same bounds.HttpClient::sec_required_document_policypre-I/O validation, serverRequest/HttpRequestaccessors with raw preservation, and rttp facade re-exports.Test plan
cargo test -p rttp-protocol --test sec_required_document_policy --test document_policy --test document_policy_report_onlycargo test -p rttp_client --test test_raw_request_capture sec_required_document_policycargo test -p rttp-server --test metadata_facadeand server unit filtersec_required_document_policycargo test -p rttp --test metadata_facade --test test_server_modelscargo test --test http11_client_server_matrix sec_required_document_policy