fix(http): distinguish binary transfer cache request bodies - #70227
Open
SkyZeroZx wants to merge 1 commit into
Open
fix(http): distinguish binary transfer cache request bodies#70227SkyZeroZx wants to merge 1 commit into
SkyZeroZx wants to merge 1 commit into
Conversation
SkyZeroZx
force-pushed
the
fix/http-transfer-cache-body-identity
branch
2 times, most recently
from
August 16, 2026 23:42
52eab8e to
d7f932d
Compare
SkyZeroZx
commented
Aug 17, 2026
| }); | ||
| }); | ||
|
|
||
| it('should not cache POST requests with Blob bodies', () => { |
Contributor
Author
There was a problem hiding this comment.
Looking into it a bit more, we could try wrapping it in observables and modifying the interceptor in transferCache, but that would be extra work and would further increase the bundle size.
I'm not sure if it's worthwhile or if we should revisit it later.
SkyZeroZx
marked this pull request as ready for review
August 17, 2026 05:01
JeanMeche
reviewed
Aug 17, 2026
| bodyForCacheKey = sortAndConcatParams(serializedBody); | ||
| } else if (serializedBody instanceof ArrayBuffer) { | ||
| bodyType = 'arrayBuffer'; | ||
| bodyForCacheKey = toBase64(serializedBody); |
Member
There was a problem hiding this comment.
I do see a concern with very large bodies here.
Contributor
Author
There was a problem hiding this comment.
updated, we can directly use the ArrayBuffer bytes to convert it to SHA-256, avoiding unnecessary conversion back to bytes.
SkyZeroZx
force-pushed
the
fix/http-transfer-cache-body-identity
branch
2 times, most recently
from
August 17, 2026 22:05
bc039fb to
8ee9f48
Compare
SkyZeroZx
commented
Aug 18, 2026
| @@ -1,5 +1,5 @@ | |||
| { | |||
| "dist/browser/main-[hash].js": 232419, | |||
| "dist/browser/main-[hash].js": 237440, | |||
Contributor
Author
There was a problem hiding this comment.
Apparently, it was not updated (or exceeded the accepted tolerance) when SHA-256 was added.
Include the serialized body type and ArrayBuffer bytes in transfer cache keys. Avoid caching Blob and FormData requests when a complete synchronous identity cannot be derived. Prevent distinct protobuf and gRPC POST payloads from sharing a cache entry during hydration. Fixes angular#70226
SkyZeroZx
force-pushed
the
fix/http-transfer-cache-body-identity
branch
from
August 19, 2026 16:16
dff1192 to
4f4bc43
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Include the serialized body type and ArrayBuffer bytes in transfer cache keys. Avoid caching Blob and FormData requests when a complete synchronous identity cannot be derived.
Prevent distinct protobuf and gRPC POST payloads from sharing a cache entry during hydration.
Fixes #70226
The impact is similar to other cache poisoning or cache-key confusion issues: distinct attacker-controlled protobuf or gRPC bodies could collide on the same cache key, causing a response cached for one request to be incorrectly reused for another during hydration , similar to advisories such as GHSA-jhpw-976m-542j and GHSA-39pv-4j6c-2g6v.
A minimal example can also be seen at https://github.com/SkyZeroZx/angular-protobuf-transfercache-poc