Phase 1: Security filter drains the request body before the route reads it #54

Merged

mph merged 5 commits from SUPP-53-phase-01 into SUPP-53

2026-09-14 19:51:15 +00:00

claude commented

2026-09-14 18:43:05 +00:00

Member

Phase 01 implementation for SUPP-53.

Files

Browse changed files: https://code.iterative.works/iterative-works/support/-/blob/SUPP-53-phase-01/

Phase 01 implementation for SUPP-53. ### Files Browse changed files: https://code.iterative.works/iterative-works/support/-/blob/SUPP-53-phase-01/

claude added 3 commits

2026-09-14 18:43:05 +00:00

chore(SUPP-53): update review-state for phase 01 dbc10762d8

Security filter drains the request body before the route reads it 387783cc95

- Buffer url-encoded bodies into a strict chunk ahead of the pac4j filter, so a single-read body reaches both the filter and the route intact
- Reject an oversized url-encoded body with a bare 413, measured rather than trusting Content-Length
- Rebuild the request with framing headers describing its buffered body
- Reject a size limit outside (0, Int.MaxValue) at construction, closing an overflow that would pass an emptied body through
- Add 19 regression tests and the HTTP-level test harness the module lacked

chore(SUPP-53): register phase 1 code review artifact 61bef424eb

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BDfb2ghkkKiwTKVrcufmaT

mph added 1 commit

2026-09-14 18:49:12 +00:00

chore(SUPP-53): update review-state for phase 01 0af9f0a465

mph added 1 commit

2026-09-14 18:52:24 +00:00

chore(SUPP-53): phase 1 PR open, awaiting review 9d6990b6d9

Repo CI triggers only on pull requests into main or release/*, so it does
not run on a phase PR into the feature branch. The four checks it would
have applied were run locally across every module and all pass:
__.compile, __.checkFormat, __.fix --check and __.test (436 tests).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BDfb2ghkkKiwTKVrcufmaT

mph merged commit 5e2dd2b4ae into SUPP-53

2026-09-14 19:51:15 +00:00

mph deleted branch SUPP-53-phase-01

2026-09-14 19:51:15 +00:00

mph referenced this pull request from a commit

2026-09-14 19:51:15 +00:00

Merge pull request 'Phase 1: Security filter drains the request body before the route reads it' (#54) from SUPP-53-phase-01 into SUPP-53

claude referenced this pull request

2026-09-14 19:59:11 +00:00

SUPP-53: buffer url-encoded request bodies so the security filter cannot drain them #59