Skip to content

fix(build): bound fixture HTTPS downloads - #573

Open
LMLiam wants to merge 1 commit into
fix/issue-380/01-safe-replacementfrom
fix/issue-380/02-bounded-https
Open

fix(build): bound fixture HTTPS downloads#573
LMLiam wants to merge 1 commit into
fix/issue-380/01-safe-replacementfrom
fix/issue-380/02-bounded-https

Conversation

@LMLiam

@LMLiam LMLiam commented Aug 16, 2026

Copy link
Copy Markdown
Owner

Summary

  • Restrict fixture downloads to HTTPS and disable automatic redirects.
  • Apply connection and read timeouts to every request.
  • Accept only 2xx responses and handle the supported redirect statuses explicitly.
  • Enforce the 128 MiB streaming limit, including inaccurate or missing Content-Length values.
  • Disconnect every response and add deterministic local-server and fake-connection tests.

Related issues

Part of #380

Type of change

  • fix: bug fix
  • test

Testing

  • ./gradlew :buildSrc:test --rerun-tasks --no-configuration-cache
  • ./gradlew build --no-configuration-cache
  • actionlint .github/workflows/ci.yml
  • git diff --check

@coderabbitai

coderabbitai Bot commented Aug 16, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 1f8f2834-90a4-4c75-b650-acf71e5cfe77

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@LMLiam LMLiam added type: bug Something is broken priority: high Needs urgent attention area: build Build, CI, publishing, project structure labels Aug 16, 2026
}

"applies the byte limit when the length is absent or inaccurate" {
val exact = connection(status = 200, body = "1234", contentLength = null)
}

"applies the byte limit when the length is absent or inaccurate" {
val exact = connection(status = 200, body = "1234", contentLength = null)
BoundedHttpsDownload.download("https://fixture.test/file", ByteArrayOutputStream(), { exact }, 4, 3, 1, 2)
exact.disconnected shouldBe 1

val oversized = connection(status = 200, body = "12345", contentLength = "1")
}
oversized.disconnected shouldBe 1

val announcedOversize = connection(status = 200, body = "1", contentLength = "5")
@LMLiam
LMLiam force-pushed the fix/issue-380/02-bounded-https branch from 6cd4f3d to 652c125 Compare August 17, 2026 12:30
@github-actions github-actions Bot removed the area: build Build, CI, publishing, project structure label Aug 17, 2026
@LMLiam
LMLiam force-pushed the fix/issue-380/02-bounded-https branch from 652c125 to 0a77d42 Compare August 17, 2026 12:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

priority: high Needs urgent attention type: bug Something is broken

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants