glm-5.3-flash
12b35e2c5f
21 review-001 tasks across server/adapters/client/gateway/websocket/infra, chunked from the 7-unit remediation plan in docs/reviews/001-initial-implementation-review.md. - Scope split by mechanism, not one-per-finding: 15 tasks in generation 1 (parallelizable), 6 sequenced after their file-sharing precursors - Deliberately deferred until dependent fixes land: projection/doc fidelity partial (Unit 6 beyond dependency hygiene), coverage backfills (COV-01..07 via in-task acceptance for forward.rs), and per-finding minors (OAI-06/07, HY-02/04/06/10/11, CON-08) - Cross-crate WS-12 (alkcall demux 4 GiB discard alloc) noted for filing in alkcall, not here taskgraph: validate clean, no cycles, 6 generations
67 lines
3.0 KiB
Markdown
67 lines
3.0 KiB
Markdown
---
|
|
id: review-001-hyper-server-knobs
|
|
name: Configure hyper timeouts + decoy/405/proxy-path fixes (SRV-04, SRV-07, SRV-08, SRV-09, SRV-10)
|
|
status: pending
|
|
depends_on: []
|
|
scope: moderate
|
|
risk: low
|
|
impact: component
|
|
level: implementation
|
|
tags: [server, review-001, stealth]
|
|
---
|
|
|
|
## Description
|
|
|
|
Review 001 server-core minors, grouped because they are small, disjoint,
|
|
and all land in `src/server/`:
|
|
|
|
- **SRV-04**: `HyperBuilder` (`src/server/adapter.rs:217-224`) sets no
|
|
timer — hyper 1.11 *silently ignores* `header_read_timeout` without one
|
|
(verified against hyper source), so the slow-loris surface is open and
|
|
every keep-alive knob is off. Set a timer (tokio) + `header_read_timeout`
|
|
+ h1/h2 keep-alive knobs. No concurrency cap exists in this crate (the
|
|
accept loop is the consumer's) — document that boundary in the module
|
|
doc.
|
|
- **SRV-05**: `with_decoy` consumes `extra_routes` via `.take()`
|
|
(`adapter.rs:104`); a second builder call silently rebuilds without the
|
|
custom routes. Clone (or error on double-build).
|
|
- **SRV-07**: the decoy is only the router `fallback` — method-mismatch
|
|
requests return axum's bare 405 with no `Server: nginx` header, which
|
|
single-handedly distinguishes alkhttp from nginx in decoy deployments
|
|
(empirically verified). Wrap 405s with the decoy response.
|
|
- **SRV-08**: `percent_decode` maps `+`→space (wrong in a URI path) and
|
|
per-byte→char (mojibake for non-ASCII filenames) — `decoy.rs:106-127`.
|
|
Fix with proper UTF-8 percent-decoding; also move the blocking
|
|
`is_dir()`/`is_file()` syscalls off the async path.
|
|
- **SRV-09**: `/openapi.json` error path echoes raw serde internals to
|
|
unauthenticated callers and re-serializes the whole projection per
|
|
request (`adapter.rs:250-254`); companion unguarded
|
|
`.expect("to_openapi always emits…")` in `to_openapi.rs:67`. Cache the
|
|
serialized doc, return a generic 500 body, remove the `expect`.
|
|
- **SRV-10**: WS upgrade hardcodes `NoCap` while the doc claims a
|
|
stricter policy is passable — add the injection point or fix the doc;
|
|
drop the double token resolution (router middleware + `ws_bearer_auth`).
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [ ] Hyper configured with timer + header read timeout; knob values documented
|
|
- [ ] 405 responses carry the decoy `Server` header (test with `OPTIONS /search`)
|
|
- [ ] `%C3%A9` and `a+b.html` resolve correctly in the decoy static server (tests); async-path syscalls gone
|
|
- [ ] `/openapi.json` 500 body is generic; doc cached; `expect` removed
|
|
- [ ] Second `.with_decoy` no longer silently drops extra routes (test)
|
|
- [ ] SRV-10: policy injection point exists or doc corrected; single token resolution
|
|
- [ ] `cargo test`, `cargo test --all-features`, `cargo clippy --all-targets -- -D warnings` pass
|
|
|
|
## References
|
|
|
|
- docs/reviews/001-initial-implementation-review.md (Part A, SRV-04..SRV-10)
|
|
- docs/architecture/decisions/010-alpn-router-and-endpoint.md
|
|
|
|
## Notes
|
|
|
|
> Agent fills during implementation. Independent of the other
|
|
> review-001 tasks; can proceed in parallel.
|
|
|
|
## Summary
|
|
|
|
> Filled on completion. |