Adversarial oversized appearance request gets proxy 502 #282

Closed
opened 2026-09-28 02:00:10 +00:00 by kayg · 1 comment
Owner

Finding

The API proxy returned 502 local adversarial server is unavailable for a hostile appearance update.

Evidence

The one time-boxed adversarial round sent a PUT /api/v1/appearance with a 200,000-character fonts.ui value. The probe expected a 4xx refusal. It received HTTP 502 from tests/adversarial/editor-proxy.mjs because the proxy could not connect to the backend. The probe also reported that the server was alive at the end of the round.

This may be a transient connection failure under shared-host load. The probe ran during other server, browser and performance work. No server crash was observed. The single probe round was not repeated.

Expected result

The appearance endpoint returns a client error for the oversized value, and the proxy does not lose its backend connection.

Reproduction

Run tests/adversarial/run.sh with a local web build and server. The oversized font case is in tests/adversarial/attack.py near line 354.

## Finding The API proxy returned `502 local adversarial server is unavailable` for a hostile appearance update. ## Evidence The one time-boxed adversarial round sent a `PUT /api/v1/appearance` with a 200,000-character `fonts.ui` value. The probe expected a 4xx refusal. It received HTTP 502 from `tests/adversarial/editor-proxy.mjs` because the proxy could not connect to the backend. The probe also reported that the server was alive at the end of the round. This may be a transient connection failure under shared-host load. The probe ran during other server, browser and performance work. No server crash was observed. The single probe round was not repeated. ## Expected result The appearance endpoint returns a client error for the oversized value, and the proxy does not lose its backend connection. ## Reproduction Run `tests/adversarial/run.sh` with a local web build and server. The oversized font case is in `tests/adversarial/attack.py` near line 354.
Author
Owner

The same one-time adversarial run reported PUT /api/v1/appearance with a 200,000-character fonts.ui value returning 502 local adversarial server is unavailable through tests/adversarial/editor-proxy.mjs. The error text is the proxy's backend-unavailable response. This occurred under heavy shared-host load; no API or proxy code was changed here.

The same one-time adversarial run reported `PUT /api/v1/appearance` with a 200,000-character `fonts.ui` value returning `502 local adversarial server is unavailable` through `tests/adversarial/editor-proxy.mjs`. The error text is the proxy's backend-unavailable response. This occurred under heavy shared-host load; no API or proxy code was changed here.
kayg closed this issue 2026-09-29 08:29:16 +00:00
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal#282
No description provided.