stacklok / toolhive / 30341972589

70%

Build Type

push

github

Committed by web-flow

Commit Message

Stop splicing whole SSE buffers into error text (#6079)

processEventStream reported an unrecognized line separator by
interpolating the entire buffer into the error string. That buffer is the
full pre-filter payload -- for a tools/list, the unfiltered tool list --
and the error is logged upstream, so a backend response with no
recognized separator produced one unbounded log line containing the very
payload the filter exists to scrub. Report the length instead, which is
the only diagnostic value the message carried.

This is the byte-identical sibling of the case fixed in
pkg/authz/response_filter.go by #6066. Fixing one and not the other was
an oversight, not a scoping decision.

Also correct a comment that contradicted its own function: it said the
authorizer error "must never be promoted to a structured field routed to
an aggregator beyond this log line" while the next statement logs it as
exactly such a field. The intent was to forbid copying it into further
log lines, not to forbid the one that is there.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Coverage Stats

0 of 3 new or added lines in 1 file covered. (0.0%)

13 existing lines in 5 files now uncovered.

81086 of 116309 relevant lines covered (69.72%)

96.5 hits per line