stacklok / toolhive / 32170314991

70%

Build Type

push

github

Committed by web-flow

Commit Message

fix(authz): commit recorded status before flushing in ResponseFilteri… (#6335)

fix(authz): commit recorded status before flushing in ResponseFilteringWriter

ResponseFilteringWriter is write-behind: Write buffers the body and
WriteHeader only records the status, with the real write and filter
happening in FlushAndFilter. Its non-2xx passthrough branch is safe only
because a fetch-based MCP client gates list delivery on response.ok
(200-299), so a non-2xx list body is never consumed.

In the production transparent-proxy path (httputil.ReverseProxy with
FlushInterval: -1), the proxy calls Flush() while copying the backend
response. The first Flush() on a fresh net/http writer commits the
headers with an implicit WriteHeader(200) before FlushAndFilter() runs.
FlushAndFilter then takes the non-2xx passthrough branch from the
recorded status (e.g. 500), its WriteHeader(500) is a no-op, and the
unfiltered buffered list body is delivered under a fabricated 200 --
the #5257-class bypass on the non-2xx branch. Legitimate 4xx/5xx
statuses are silently rewritten to 200 as well.

Commit the recorded status (rfw.statusCode) in Flush() before flushing
downstream, so the wire status reflects the real backend status. SSE
(statusCode 200) is unaffected and later WriteHeader calls in
FlushAndFilter become no-ops instead of corrupting the status.

Adds a regression test over the production wiring (real HTTP server +
ReverseProxy FlushInterval:-1) asserting a 500/404 list response reaches
the client with the non-2xx status while 2xx responses are still
filtered. The test fails without the fix (status rewritten to 200).

Coverage Stats

1 of 1 new or added line in 1 file covered. (100.0%)

6 existing lines in 2 files now uncovered.

85453 of 121349 relevant lines covered (70.42%)

98.81 hits per line