Bump Java HTTP to 1.4.2 - #54
Merged
Merged
Conversation
Problems 1. When handling chunked transfer encoding, if we can't read a byte from the underlying pushback stream, we end up an infinite loop. We also don't handle offset/dLen edge cases well and do not deliberately handle chunk sizes larger than Integer.MAX_VALUE. 2. Old IPR file style (modern IJ crashes) 3. Pre Savant 2.2.0 style IML 4. IJ's TestNG run config template could not properly run tests 5. GHA did not run tests on PRs and had old Savant version. Solutions 1. When handling chunked transfer encoding, if we can't read a byte from the underlying pushback stream, then bail. Also simplify and cover other edge cases (length of zero, length/offset bigger than destination buffer, and conflation of index/length). 2. Convert to the .idea directory 3. IML update. 4. Standard run config 5. Have GHA run tests on PRs and update Savant version.
JohnBergant
changed the title
There was a problem hiding this comment.
Pull request overview
This PR bumps java-http to 1.4.2 and focuses on hardening chunked transfer decoding (preventing hangs / handling offset+length edge cases and oversized chunk sizes), while also modernizing IntelliJ project files and updating CI to run tests on pull requests.
Changes:
- Fix/refactor
ChunkedInputStreamto better handle chunked parsing edge cases (incomplete reads, offset/length validation, oversized chunk sizes). - Expand chunked-related test coverage, including new regression cases.
- Migrate IntelliJ project config from legacy
.iprto.idea/, and update GitHub Actions workflow + Savant bootstrap.
Reviewed changes
Copilot reviewed 10 out of 19 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| src/main/java/io/fusionauth/http/io/ChunkedInputStream.java | Refactors chunked decoding logic and adds explicit handling for edge cases and oversized chunk sizes. |
| src/test/java/io/fusionauth/http/io/ChunkedInputStreamTest.java | Adds regression tests for chunked parsing edge cases (offset/length, incomplete streams, oversized chunk size). |
| src/test/java/io/fusionauth/http/ChunkedTest.java | Adds integration test for integer-overflow chunk sizes and keeps existing chunked request/response coverage. |
| pom.xml | Bumps Maven artifact version to 1.4.2. |
| build.savant | Bumps Savant project version to 1.4.2. |
| .github/workflows/test.yml | Runs tests on PRs, updates runner/tooling, and updates Savant installation steps. |
| java-http.iml | Updates IntelliJ module metadata (dependency paths/source jars). |
| load-tests/tomcat/tomcat.iml | Normalizes module file formatting. |
| load-tests/self/self.iml | Normalizes module file formatting. |
| java-http.ipr | Removes legacy IntelliJ .ipr project file. |
| .idea/vcs.xml | Adds modern IntelliJ VCS mapping. |
| .idea/runConfigurations/_template__of_TestNG.xml | Adds standard TestNG run configuration template. |
| .idea/modules.xml | Adds IntelliJ modules list for the project. |
| .idea/misc.xml | Adds project SDK/language level configuration. |
| .idea/libraries/_kts_definition_dependencies.xml | Adds Kotlin script definition dependency library entry used by IntelliJ. |
| .idea/copyright/profiles_settings.xml | Adds IntelliJ copyright profile settings. |
| .idea/copyright/Apache_v2.xml | Adds IntelliJ Apache v2 copyright notice template. |
| .idea/compiler.xml | Adds IntelliJ compiler/javac options configuration. |
| .idea/.gitignore | Adds ignores for user-local IntelliJ files inside .idea/. |
Files not reviewed (9)
- .idea/.gitignore: Generated file
- .idea/compiler.xml: Generated file
- .idea/copyright/Apache_v2.xml: Generated file
- .idea/copyright/profiles_settings.xml: Generated file
- .idea/libraries/_kts_definition_dependencies.xml: Generated file
- .idea/misc.xml: Generated file
- .idea/modules.xml: Generated file
- .idea/runConfigurations/_template__of_TestNG.xml: Generated file
- .idea/vcs.xml: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+28
to
31
| savant-2.2.0/bin/sb --version | ||
| SAVANT_PATH=$(realpath -s "./savant-2.2.0/bin") | ||
| echo "${SAVANT_PATH}" >> $GITHUB_PATH | ||
| mkdir -p ~/.savant/plugins |
Comment on lines
+80
to
+82
| if (delegateBufferLength == -1) { | ||
| return -1; | ||
| } |
Comment on lines
+177
to
+178
| // I'm not sure what the need for this is as of now. None of the existing code paths use it. could be | ||
| // useful for HTTP/2 in the future |
Comment on lines
+223
to
+224
| @Test | ||
| public void chunk_larger_than_32_bytes() throws IOException { |
wied03
approved these changes
Sep 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problems
Solutions