solidjs / solid / 33426543190

72%

main: 89%

push

github

fix: enforce Location/X-Revalidate bounds at the transport edge (#3158)

redirect() and initWithRevalidate refuse over-long values because a
header past a receiver's limit is dropped or rejected by the proxy
after the mutation committed — but a hand-built Response reached the
transport with no helper in the loop, shipping a ~1 MB redirect header
to die at the socket. The bound is now enforced once, post-dispatch,
where the composed headers leave — covering returned and thrown, raw
and envelope-carried, masked and passthrough producers — with the
helpers' authoring-time throws as the legible fast path. Refused,
never trimmed, for the helpers' own reasons; the refusal still carries
the event stub's cookies (#3159 ordering).

Co-authored-by: Cursor <cursoragent@cursor.com>

517 of 791 branches covered (65.36%)

Branch coverage included in aggregate %.

767 of 1003 relevant lines covered (76.47%)

14.53 hits per line