Reject Model Target requests with a non-integer Content-Length - #3442
Merged
Conversation
Towards #3400. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Towards #3400.
What
#3400 points out that the six cross-cutting test modules which the
endpointfixture feeds do not cover the Model Target Web API. Themodel_target_endpointfixture now covers theAuthorizationheader and the invalid-body concerns, but notContent-Length.The mock did no
Content-Lengthhandling at all for Model Target routes, so a header which is not an integer reached the bearer token check and got a401where real Vuforia gives a400.Real Vuforia behavior
Model Target routes are served from
vws.vuforia.com, behind the same load balancer as the VWS API, and a non-integerContent-Lengthis rejected before the request reaches any API. This is verifiable without an access token, so unlike most Model Target work it is not blocked by the revoked OAuth2 credentials (#3441). Observed forPOST /modeltargets/datasets,POST /modeltargets/advancedDatasets, the status, download and delete routes for both dataset types, andPOST /oauth2/token:That is the same response the VWS API gives, which the mock already models as
ContentLengthHeaderNotIntError.A
Content-Lengthwhich is too small truncates the body. The Model Target Web API does not sign the request body, so it has no reason to notice the truncation before it looks at theAuthorizationheader, and it returns the usual401/no Bearer token. The mocks already matched.Changes
400response for aContent-Lengthheader which is not an integer, reusingContentLengthHeaderNotIntErrorso the body and headers stay in one place.TestContentLengthintests/mock_vws/test_model_target_web_api.py, running over every Model Target endpoint via themodel_target_endpointfixture, plus a case for the OAuth2 token endpoint which that fixture excludes.Content-Lengthwhich is too large is left uncovered, as it is for the VWS API: real Vuforia waits for the body it was promised and then times out, which is too slow for a test. This is noted in the test class docstring.Testing
TestContentLengthpasses against the real Vuforia, in-memory mock and Docker-in-memory backends. The whole non-real suite passes:1469 passed, 22 skipped.🤖 Generated with Claude Code