Skip to content

Validate event stream header lengths and fixed-width values in encoder - #3459

Merged
ashishdhingra merged 3 commits into
version-3from
eventstream-header-validation
Oct 20, 2026
Merged

ashishdhingra merged 3 commits into
version-3from
eventstream-header-validation

Conversation

@ashishdhingra

Copy link
Copy Markdown
Contributor

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Description

The aws-eventstream encoder now validates header fields against the event stream protocol limits before serializing a message, and raises an error instead of writing a value that doesn't fit its field.

aws-eventstream

  • Header names longer than 255 encoded bytes raise EventHeaderNameLengthExceedError.
  • string and bytes header values longer than 32,767 encoded bytes raise EventHeaderValueLengthExceedError.
  • Fixed-width header values that don't fit their type raise EventHeaderValueWidthError: uuid values must be exactly 16 bytes, and byte, short, integer, long, and timestamp values must fit their signed width.
  • Lengths are measured in encoded bytes, not characters.
  • Validation runs before anything is written, so a rejected message writes nothing to the output IO.

aws-sdk-core

  • Requires aws-eventstream >= 1.4.1.
  • MINIMUM_CORE_VERSION for newly built service gems is bumped to 3.259.0.

Changelog entries are under Unreleased Changes for both gems.

Testing

  • aws-eventstream specs: 46 examples, 0 failures. New cases cover 255/256-byte names; 32,767/32,768/65,536-byte string and bytes values; multibyte values whose character count is within the limit but whose byte length exceeds it; valid and invalid widths for each fixed-width type; and failure atomicity.

Generated by AI tools (Claude Code), and reviewed by Ashish Dhingra.

@ashishdhingra
ashishdhingra force-pushed the eventstream-header-validation branch from 3645cd7 to afdbee9 Compare October 20, 2026 18:10
@ashishdhingra

ashishdhingra commented Oct 20, 2026 •

Copy link
Copy Markdown
Contributor Author

Dry-run triggered:

{
  "buildId": "5714428c-1b1e-4328-bcf8-8d4374e5305b",
  "buildType": "DRY_RUN",
  "stage": "PROD",
  "overrides": {
    "sources": [
      {
        "sourceId": "aws-sdk-ruby",
        "sourceReference": "eventstream-header-validation"
      }
    ]
  }
}

Comment thread build_tools/services.rb Outdated

# Minimum `aws-sdk-core` version for new gem builds
MINIMUM_CORE_VERSION = "3.258.0"
MINIMUM_CORE_VERSION = "3.259.0"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please recheck the bump after release today.

@ashishdhingra
ashishdhingra marked this pull request as ready for review October 20, 2026 19:04
@ashishdhingra
ashishdhingra requested review from a team as code owners October 20, 2026 19:04

describe '#encode header length validation' do

def message_with_header(key, value)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Non-blocking: message_with_header is defined the same way in both new describe blocks here and on L182. Could it move up one level so it's shared?

Reject header names over 255 encoded bytes and string/bytes values over
32,767 encoded bytes before serialization, instead of truncating the length
field into the protocol's 8-bit/16-bit length. Adds regression tests and a
changelog entry.
Reject uuid header values that are not exactly 16 bytes, which would
otherwise misalign the header block, and range-check byte, short, integer,
long and timestamp values against their signed width instead of letting
pack silently truncate them. Adds tests and a changelog entry.
Core 3.259.0 was released before this change merged, so the
aws-eventstream dependency bump ships in 3.260.0.
@ashishdhingra
ashishdhingra force-pushed the eventstream-header-validation branch from afdbee9 to eefbaee Compare October 20, 2026 23:11
@ashishdhingra

ashishdhingra commented Oct 20, 2026 •

Copy link
Copy Markdown
Contributor Author

New dry-run started after changing MINIMUM_CORE_VERSION to 3.260.0:

{
  "buildId": "2785026d-e3d3-4d6a-8fa1-25d04d1a7dda",
  "buildType": "DRY_RUN",
  "stage": "PROD",
  "overrides": {
    "sources": [
      {
        "sourceId": "aws-sdk-ruby",
        "sourceReference": "eventstream-header-validation"
      }
    ]
  }
}

@ashishdhingra
ashishdhingra merged commit 824e96b into version-3 Oct 20, 2026
34 checks passed
@ashishdhingra
ashishdhingra deleted the eventstream-header-validation branch October 20, 2026 23:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants