fix: negative Content-Length no longer bypasses bodySizeLimit (#3153)

Number("-1") is -1: neither `> limit` nor falsy, so a negative declared
length satisfied neither guard and the body streamed into the decoder
uncapped (195x the configured limit in the report). Validate the string
form — only a plain digit string is a declaration worth trusting to the
HTTP server's framing — and route anything non-conforming through the
bounded buffer alongside undeclared bodies.

Unreachable on stock node:http (its parser refuses the header first);
hardening for hand-rolled adapters, laxer edge parsers, and rewriting
proxies. Reported by @frenzzy with the guard-by-guard analysis and fix.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: ryansolid

.changeset/fix-content-length-guard-bypass.md

@@ -0,0 +1,5 @@
+---
+"@solidjs/web": patch
+---
+
+Trust only a conforming (digit-string) Content-Length in the bodySizeLimit guard: a negative declaration (`-1`) satisfied neither the over-limit check nor the undeclared-body buffer path and streamed the body into the decoder uncapped; non-conforming declarations now route through the bounded buffer (#3153)

packages/web/server-functions/src/server.ts

@@ -2382,10 +2382,11 @@ export async function handleServerFunctionRequest(request, options = {}) {
 
   // The argument payload is buffered and decoded before dispatch, so its
   // cost is paid before application code can decline it — bound it before
-  // paying (#3115). A declared Content-Length is trusted (the HTTP server's
-  // framing enforces it); a body without one is buffered under the cap. The
-  // `?args=` encoding is the same payload on a different road, so it gets
-  // the same ceiling.
+  // paying (#3115). A CONFORMING declared Content-Length is trusted (the
+  // HTTP server's framing enforces it); a body without one — or with a
+  // declaration that isn't a plain digit string (#3153) — is buffered under
+  // the cap. The `?args=` encoding is the same payload on a different road,
+  // so it gets the same ceiling.
   const bodySizeLimit =
     options.bodySizeLimit !== undefined ? options.bodySizeLimit : config.bodySizeLimit;
   const argsEncoding = url.searchParams.get("args");
@@ -2397,15 +2398,24 @@ export async function handleServerFunctionRequest(request, options = {}) {
     return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
   }
   if (method === "POST" && request.body !== null && bodySizeLimit !== Infinity) {
-    const declared = Number(request.headers.get("content-length"));
+    // Trust only a CONFORMING declaration — digits, per RFC 9110 §8.6. The
+    // bare Number() parse lost that information: Number("-1") is -1, which
+    // is neither `> limit` nor falsy, so a negative declaration satisfied
+    // NEITHER guard and the body streamed into the decoder uncapped
+    // (#3153). A stock node:http parser refuses it first, but an adapter
+    // that builds the Request itself, or a rewriting proxy, delivers it
+    // here — anything non-conforming now routes through the bounded buffer
+    // alongside the undeclared bodies.
+    const raw = request.headers.get("content-length");
+    const declared = raw !== null && /^\d+$/.test(raw) ? Number(raw) : NaN;
     if (declared > bodySizeLimit) {
       const response = new Response(
         DEV ? "Server function request body exceeds the configured bodySizeLimit" : null,
         { status: 413 }
       );
       return finalizeTransportResponse(protectsRequest ? withCSRFVary(response) : response, method);
     }
-    if (!declared) {
+    if (!(declared > 0)) {
       const bounded = await bufferBodyWithin(request, bodySizeLimit);
       if (bounded === null) {
         const response = new Response(

packages/web/test/server/server-functions-request-bounds.spec.tsx

@@ -88,6 +88,56 @@ describe("the body size bound", () => {
     expect(response.status).toBe(200);
   });
 
+  it("routes a non-conforming Content-Length through the cap instead of trusting it (#3153)", async () => {
+    // Number("-1") is -1: neither `> limit` nor falsy, so a negative
+    // declaration satisfied neither guard and the body streamed in uncapped
+    // — 195× the configured limit in the report. A stock node:http parser
+    // refuses the header first; an adapter that builds the Request itself,
+    // or a proxy that rewrites the header (a decompressor preserving the
+    // compressed length), delivers it here.
+    const fn = vi.fn(async (s: string) => s.length);
+    registerServerFunction("bounds-negative-length", fn);
+    const oversized = JSON.stringify(["x".repeat(200_000)]);
+
+    // (" 5 " is unreachable here: the Headers layer itself trims OWS, so the
+    // guard sees a conforming "5")
+    for (const raw of ["-1", "+5", "abc,def"]) {
+      const response = await handleServerFunctionRequest(
+        new Request("https://app.example/_server/data/bounds-negative-length", {
+          method: "POST",
+          body: oversized,
+          headers: {
+            "Sec-Fetch-Site": "same-origin",
+            "X-Server-Function-Instance": "server-function:test",
+            "content-length": raw,
+            [BODY_FORMAT_HEADER]: JSON_FORMAT
+          }
+        }),
+        { bodySizeLimit: 1024 }
+      );
+      expect([raw, response.status]).toEqual([raw, 413]);
+    }
+    expect(fn).not.toHaveBeenCalled();
+
+    // control: a conforming declaration within the limit still dispatches
+    const body = JSON.stringify(["ok"]);
+    const accepted = await handleServerFunctionRequest(
+      new Request("https://app.example/_server/data/bounds-negative-length", {
+        method: "POST",
+        body,
+        headers: {
+          "Sec-Fetch-Site": "same-origin",
+          "X-Server-Function-Instance": "server-function:test",
+          "content-length": String(body.length),
+          [BODY_FORMAT_HEADER]: JSON_FORMAT
+        }
+      }),
+      { bodySizeLimit: 1024 }
+    );
+    expect(accepted.status).toBe(200);
+    expect(fn).toHaveBeenCalledTimes(1);
+  });
+
   it("applies the same ceiling to the ?args= encoding", async () => {
     const response = await handleServerFunctionRequest(urlArgs(JSON.stringify(["y"])), {
       bodySizeLimit: 4