Skip to content

opt: block merge for hop-by-hop headers, close #1452#1463

Merged
looplj merged 1 commit into
unstablefrom
dev-tmp
Apr 23, 2026
Merged

opt: block merge for hop-by-hop headers, close #1452#1463
looplj merged 1 commit into
unstablefrom
dev-tmp

Conversation

@looplj

@looplj looplj commented Apr 23, 2026

Copy link
Copy Markdown
Owner

@greptile-apps greptile-apps Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looplj has reached the 50-review limit for trial accounts. To continue receiving code reviews, upgrade your plan.

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional findings.

Open in Devin Review

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request enhances header filtering in MergeHTTPHeaders by blocking standard hop-by-hop headers and dynamically identified connection-specific headers listed in Connection or Proxy-Connection fields. Feedback highlights a potential security vulnerability where non-canonical header keys could bypass existing filters, and suggests improving efficiency by lazily initializing the header map only when necessary.

Comment thread llm/httpclient/utils.go Outdated
Comment on lines 243 to 259
connectionSpecificHeaders := make(map[string]bool)
for _, headerKey := range []string{"Connection", "Proxy-Connection"} {
for _, headerValue := range src.Values(headerKey) {
for _, token := range strings.Split(headerValue, ",") {
token = strings.TrimSpace(token)
if token == "" {
continue
}

connectionSpecificHeaders[http.CanonicalHeaderKey(token)] = true
}
}
}

for k, v := range src {
if sensitiveHeaders[k] || libManagedHeaders[k] || isBlockedHeader(k) {
if sensitiveHeaders[k] || libManagedHeaders[k] || isBlockedHeader(k) || connectionSpecificHeaders[k] {
continue

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

The current implementation has two areas for improvement:

  1. Efficiency: The connectionSpecificHeaders map is allocated on every call to MergeHTTPHeaders. It is more efficient to initialize it lazily only if connection-specific headers (like Connection or Proxy-Connection) are actually present in the source.
  2. Correctness & Security: The loop iterates over src using raw keys. If the source headers contain non-canonical keys (e.g., lowercase authorization), they will bypass the filters for sensitive, blocked, and connection-specific headers. Canonicalizing the key at the start of the loop ensures that all security and hop-by-hop filters are applied reliably and that the destination header map is normalized.

@greptile-apps greptile-apps Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looplj has reached the 50-review limit for trial accounts. To continue receiving code reviews, upgrade your plan.

@looplj looplj merged commit f225383 into unstable Apr 23, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant