pjfanning commented on PR #1242: URL: https://github.com/apache/pekko-http/pull/1242#issuecomment-5478547158
I verified the model's claims against the source and pushed 17cbbf6bc with corrections — three things did not survive the check: 1. **§5 "writes no files" was false.** `fileUploadAll` creates temp files via `Files.createTempFile` + `deleteOnExit`, and `storeUploadedFile(s)` streams entity bytes to an application-chosen destination (`FileUploadDirectives.scala:178`). The scan behind §14 Q9 missed it. §5 now states the accurate boundary (writes happen only through upload directives the application installs) and Q9 records the correction. 2. **Q3 is now answered — as a correction, and it found a real bug.** `checkIsSafeDescendant` compared canonical paths as *strings*: with `/var/www` served, a symlink resolving into `/var/www-private/` passed `startsWith` and the file was served. That is exactly the §5b.4 "walked out of" class, disposition `VALID`, and #1218 (in flight) fixes it by comparing path elements. That fix also settles the draft's symlink residual: an escape from the root is a `VALID` finding, not an operator responsibility. §9, §15 and the status/tally lines updated to match — the "all ten answered" claim is now actually true (the status previously also said "Q1-Q8 answered" with Q3 still ending in an open question). 3. **The commit pin was self-referential.** `444d939` is this PR's own first commit; the pin now points at `85d7243`, the `main` commit the branch is based on, which is where the cited line numbers were verified. Also added to §12: #1217 proposes replacing the per-upload `deleteOnExit` with a shutdown hook registered by Pekko HTTP itself, which on merge invalidates the §5 "registers no shutdown hook" claim and its §11a non-finding — whichever of these lands second needs to reconcile. For the record, the rest verified clean: the full §5a table against `reference.conf`, the CORS echo-with-credentials behaviour (`CorsSettingsImpl.scala:63-67`), the P7 CONTINUATION accumulation bound (`HeaderDecompression.scala:171`), `secure_==`, and the `extractClientIP`/`extractDirectClientIP` split. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
