Adversarial proxy returns a false 502 for oversized Appearance body #283

Closed
opened 2026-09-28 02:47:49 +00:00 by kayg · 1 comment
Owner

Evidence

One run of the adversarial suite reported:

  • PUT /api/v1/appearance with a 3 MiB + 1 byte body returned 502 with local adversarial server is unavailable through the local adversarial proxy.
  • The probe expected 413 and recorded a non-SLOW finding.
  • A direct request with the same body, sent to the same live local server, returned 413 with Failed to buffer the request body: length limit exceeded.
  • The server was alive after the probe.

This points to the adversarial proxy path. The API itself rejected the oversized body. The existing status expectation stays unchanged. Please check the Expect: 100-continue handling in tests/adversarial/editor-proxy.mjs and the oversized body probe in tests/adversarial/attack.py.

## Evidence One run of the adversarial suite reported: - `PUT /api/v1/appearance` with a 3 MiB + 1 byte body returned `502` with `local adversarial server is unavailable` through the local adversarial proxy. - The probe expected `413` and recorded a non-SLOW finding. - A direct request with the same body, sent to the same live local server, returned `413` with `Failed to buffer the request body: length limit exceeded`. - The server was alive after the probe. This points to the adversarial proxy path. The API itself rejected the oversized body. The existing status expectation stays unchanged. Please check the `Expect: 100-continue` handling in `tests/adversarial/editor-proxy.mjs` and the oversized body probe in `tests/adversarial/attack.py`.
Author
Owner

Repeated proxy evidence during #303's single adversarial run (2026-09-28): oversized appearance requests returned 502 local adversarial server is unavailable through the local proxy; the server was still alive at the end. This matches the existing proxy-path finding. The run was under sustained shared-host load, and I did not retry it.

Repeated proxy evidence during #303's single adversarial run (2026-09-28): oversized appearance requests returned `502 local adversarial server is unavailable` through the local proxy; the server was still alive at the end. This matches the existing proxy-path finding. The run was under sustained shared-host load, and I did not retry it.
kayg closed this issue 2026-09-29 08:29:17 +00:00
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal#283
No description provided.