Correct false positives in adversarial DAV and body-size probes #394

Closed
opened 2026-09-29 04:23:29 +00:00 by kayg · 1 comment
Owner

The quota job's one adversarial run reported two non-SLOW findings that came from the probe rather than a server behavior regression:

  • attack.py sends an empty-body PROPFIND to /dav/calendars/{user}/journal/ and then requires calendar-home-set. That CalDAV property belongs to the principal resource. crates/calternal-dav/tests/apple_replay.rs already requests it from /dav/principals/{user}/ and verifies the collection separately.
  • The 3 MiB appearance request went through editor-proxy.mjs. The reported 502 local adversarial server is unavailable is generated by the test proxy's upstream socket error handler, so it does not establish that the API returned a 5xx. Send this body-size probe directly to the server, as other probes do for limits, or preserve the backend response when it rejects the body.

Please correct the probe and add coverage for the intended server response. Evidence: ADVERSARIAL_API_ONLY=1 ADVERSARIAL_SKIP_WEB_BUILD=1 tests/adversarial/run.sh reported DAV discovery :: unexpected response 207 and appearance oversized body :: 502 b'local adversarial server is unavailable'; the runner was not repeated.

The quota job's one adversarial run reported two non-SLOW findings that came from the probe rather than a server behavior regression: - `attack.py` sends an empty-body `PROPFIND` to `/dav/calendars/{user}/journal/` and then requires `calendar-home-set`. That CalDAV property belongs to the principal resource. `crates/calternal-dav/tests/apple_replay.rs` already requests it from `/dav/principals/{user}/` and verifies the collection separately. - The 3 MiB appearance request went through `editor-proxy.mjs`. The reported `502 local adversarial server is unavailable` is generated by the test proxy's upstream socket error handler, so it does not establish that the API returned a 5xx. Send this body-size probe directly to the server, as other probes do for limits, or preserve the backend response when it rejects the body. Please correct the probe and add coverage for the intended server response. Evidence: `ADVERSARIAL_API_ONLY=1 ADVERSARIAL_SKIP_WEB_BUILD=1 tests/adversarial/run.sh` reported `DAV discovery :: unexpected response 207` and `appearance oversized body :: 502 b'local adversarial server is unavailable'`; the runner was not repeated.
Author
Owner

The job/small-bugs-2 one-time API round at head 17598901 reproduced this on 2026-09-29. ADVERSARIAL_API_ONLY=1 ADVERSARIAL_SKIP_WEB_BUILD=1 returned DAV discovery :: unexpected response 207 and appearance oversized body :: 502 b'local adversarial server is unavailable'. The 3 MiB Appearance case earlier in the same run also returned that proxy-generated 502 instead of 413; the server was alive at the end. These are recorded as unresolved probe findings. The run was under shared-host load and was not repeated.

The `job/small-bugs-2` one-time API round at head `17598901` reproduced this on 2026-09-29. `ADVERSARIAL_API_ONLY=1 ADVERSARIAL_SKIP_WEB_BUILD=1` returned `DAV discovery :: unexpected response 207` and `appearance oversized body :: 502 b'local adversarial server is unavailable'`. The 3 MiB Appearance case earlier in the same run also returned that proxy-generated 502 instead of 413; the server was alive at the end. These are recorded as unresolved probe findings. The run was under shared-host load and was not repeated.
kayg closed this issue 2026-09-29 08:31:25 +00:00
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal#394
No description provided.