Synthetic cold Mail body fallback returns 500 before content preparation #1552

Open
opened 2026-10-10 15:52:15 +00:00 by kayg · 0 comments
Owner

Found while setting up the focused #1533 / #1539 adversarial probe. Opening a test-only cold clone before its content job runs sends GET /api/v1/mail/messages/cccccccc-cccc-4ccc-8ccc-ccccccccccd1/body to the synthetic account, which has no provider MIME body. The same probe on merged release build and production dbd621434 returns 500 at that path (29.6 s / 30.2 s). The sanitized body then renders inert; no script, dialog or external browser request runs. This is a pre-existing provider-fallback response exposed by out-of-band fixture insertion, not a sanitizer merge regression. Review whether that failed upstream fetch should be a calm unavailable response. The focused containment fixture is corrected to queue and await content preparation through the supported preference API before opening, since it tests prepared hostile HTML and has no provider service. No 5xx assertion was weakened. The raw comparison logs are preserved in the merge37 evidence archive.

Found while setting up the focused #1533 / #1539 adversarial probe. Opening a test-only cold clone before its content job runs sends GET /api/v1/mail/messages/cccccccc-cccc-4ccc-8ccc-ccccccccccd1/body to the synthetic account, which has no provider MIME body. The same probe on merged release build and production dbd621434 returns 500 at that path (29.6 s / 30.2 s). The sanitized body then renders inert; no script, dialog or external browser request runs. This is a pre-existing provider-fallback response exposed by out-of-band fixture insertion, not a sanitizer merge regression. Review whether that failed upstream fetch should be a calm unavailable response. The focused containment fixture is corrected to queue and await content preparation through the supported preference API before opening, since it tests prepared hostile HTML and has no provider service. No 5xx assertion was weakened. The raw comparison logs are preserved in the merge37 evidence archive.
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1552
No description provided.