Skip to content

fix(wsapprover): non-blocking approval response relay (L-3) - #75

Merged
jkyberneees merged 1 commit into
mainfrom
fix/l3-wsapprover-race
Jul 18, 2026
Merged

fix(wsapprover): non-blocking approval response relay (L-3)#75
jkyberneees merged 1 commit into
mainfrom
fix/l3-wsapprover-race

Conversation

@jkyberneees

@jkyberneees jkyberneees commented Jul 18, 2026

Copy link
Copy Markdown
Contributor

Closes L-3 in sec_findings.md.

  • HandleResponse now uses a non-blocking send on the buffer-1 response channel, so duplicate/late approval responses are dropped instead of wedging the WebSocket read goroutine and leaking a connection slot.
  • Added TestWSApprover_HandleResponse_DoesNotBlock regression test.
  • Updated docs/SECURITY.md and AGENTS.md to document the relay behaviour.

Full test suite passes: go test ./... -count:1.

Previously HandleResponse did a blocking send on a buffer-1 channel.
A duplicate or late approval_response could wedge the WebSocket read
goroutine and exhaust the global connection semaphore.

- Use select/default so surplus responses are dropped.
- Add regression test verifying the second HandleResponse returns
  promptly without blocking.
- Document the relay behaviour in SECURITY.md and AGENTS.md.

Closes L-3 in sec_findings.md.
@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs
odek c23d198 Commit Preview URL

Branch Preview URL
Jul 18 2026, 07:29 PM

@jkyberneees
jkyberneees merged commit f8ecfe4 into main Jul 18, 2026
6 of 7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant