Skip to content

fix(client): don't block on responses without headers - #553

Merged
Mzack9999 merged 3 commits into
projectdiscovery:mainfrom
d0xeon:fix/headerless-response-block
Nov 7, 2026
Merged

Mzack9999 merged 3 commits into
projectdiscovery:mainfrom
d0xeon:fix/headerless-response-block

Conversation

@d0xeon

@d0xeon d0xeon commented Oct 30, 2026 •

Copy link
Copy Markdown
Contributor

Fixes #554

ReadResponse peeked five bytes ahead while skipping duplicate status lines.
A response without headers — for example a proxy's 200 Connection established
reply to CONNECT — never supplies those bytes, so Peek blocked until the
connection deadline, or forever when no deadline was set (the proxy dialer sets
none). This is a regression from #542.

Parse the header section line by line instead, still skipping duplicate status
lines. Reading is driven by lines that actually arrive, which also handles
status lines split across TCP writes.

Tests: go test -race ./... passes, including new coverage for a headerless
response on a live connection and duplicate status lines arriving across writes.

ReadResponse peeked five bytes ahead while skipping duplicate status
lines. A response with no headers - for example a proxy's
"200 Connection established" reply to CONNECT - never supplies those
bytes, so Peek blocked until the connection deadline, or forever when no
deadline was set, as with the proxy dialer.

Parse the header section line by line instead. Duplicate status lines are
still skipped, and reading is driven by real lines rather than lookahead,
so fragmented responses are handled as well.
@Mzack9999 Mzack9999 linked an issue Oct 31, 2026 that may be closed by this pull request

@dwisiswant0 dwisiswant0 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lint failed.

The lint job timed out on cold runners: setup-go found no module or build
cache, and golangci-lint spent its whole 5m timeout in package loading
("go/packages: context deadline exceeded", exit code 4) before running
any analysis.

Download the module graph first so package loading does not spend the
lint budget on downloads, and raise the timeout to 10m for the cold build
cache.
@d0xeon
d0xeon requested a review from dwisiswant0 November 6, 2026 16:18
Comment thread .github/workflows/lint-test.yml Outdated
Comment on lines +17 to +21
# Package loading downloads and type-checks every dependency. On a
# cold runner that can exceed the lint timeout, so warm the module
# cache first and allow more time.
- name: Download modules
run: go mod download

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Revert this. Let me rerun failed job instead.

@Mzack9999

Copy link
Copy Markdown
Member

@coderabbitai review

@Mzack9999
Mzack9999 merged commit e3fbc6c into projectdiscovery:main Nov 7, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Headerless responses block while skipping duplicate status lines

3 participants