Skip to content

fix(har): off-by-one in WebSocket frame header size calculation#41143

Open
yen0304 wants to merge 1 commit into
microsoft:mainfrom
yen0304:fix-websocket-transfersize-boundary
Open

fix(har): off-by-one in WebSocket frame header size calculation#41143
yen0304 wants to merge 1 commit into
microsoft:mainfrom
yen0304:fix-websocket-transfersize-boundary

Conversation

@yen0304
Copy link
Copy Markdown

@yen0304 yen0304 commented Jun 4, 2026

Summary

  • Fix boundary condition in WebSocket frame header size calculation: length > 2 ** 16length >= 2 ** 16
  • Per RFC 6455 Section 5.2, a payload of exactly 65536 bytes requires the 64-bit extended length field (16-bit unsigned max is 65535)
  • Add test for the exact boundary (2**16 bytes payload)

Fixes #41142

A payload of exactly 65536 (2**16) bytes cannot fit in a 16-bit unsigned
integer and requires the 64-bit extended payload length field per RFC 6455
Section 5.2. The previous condition `length > 2 ** 16` missed this boundary,
causing `response._transferSize` to be 6 bytes too small.
@yury-s yury-s requested a review from dcrousso June 4, 2026 17:37
Copy link
Copy Markdown
Contributor

@dcrousso dcrousso left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice catch!

it('should use 64-bit extended length for exactly 2**16 byte websocket payload', async ({ contextFactory, server }, testInfo) => {
// RFC 6455 Section 5.2: 16-bit extended length covers 126-65535.
// Payloads of exactly 65536 (2**16) bytes require the 64-bit extended length field.
const incoming = 'x'.repeat(2 ** 16);
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

rather than adding an entirely new test for this, lets just update the test right above

-const incoming = 'x'.repeat(2 ** 16 + 1);
+const incoming = 'x'.repeat(2 ** 16);

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(har): off-by-one in WebSocket frame header size calculation

2 participants