Stream: git-wasmtime

Topic: wasmtime / PR #13636 validate content-length is decimal d...

Wasmtime GitHub notifications bot (Jun 13 2026 at 20:12):

netliomax25-code opened PR #13636 from netliomax25-code:wasi-http-content-length-digits to bytecodealliance:main:

1. get_content_length and the p3 parse_header_value read Content-Length with u64's FromStr, which also accepts a leading +, so a value like +5 is parsed as 5.
2. RFC 9110 defines the field value as 1*DIGIT, so a value like that is accepted here while a strict parser (a proxy or the peer) would reject it. The parsed value drives the p2 and p3 request/response body framing, and parse_header_value runs when a guest builds a field map.

Reject any content-length value that is not a non-empty run of ASCII decimal digits before parsing, at both sites. Added unit tests covering +5, -5, a leading space, and the empty value.

Wasmtime GitHub notifications bot (Jun 13 2026 at 20:12):

netliomax25-code requested pchickey for a review on PR #13636.

Wasmtime GitHub notifications bot (Jun 13 2026 at 20:12):

netliomax25-code requested wasmtime-wasi-reviewers for a review on PR #13636.

Wasmtime GitHub notifications bot (Jun 15 2026 at 14:28):

:thumbs_up: alexcrichton submitted PR review:

Thanks!

Wasmtime GitHub notifications bot (Jun 15 2026 at 14:28):

alexcrichton added PR #13636 validate content-length is decimal digits in wasi-http to the merge queue.

Wasmtime GitHub notifications bot (Jun 15 2026 at 14:54):

:check: alexcrichton merged PR #13636.

Wasmtime GitHub notifications bot (Jun 15 2026 at 14:54):

alexcrichton removed PR #13636 validate content-length is decimal digits in wasi-http from the merge queue.

Last updated: Jul 29 2026 at 05:03 UTC