fix(fetch): reject forbidden HTTP methods CONNECT, TRACE, and TRACK#5203
fix(fetch): reject forbidden HTTP methods CONNECT, TRACE, and TRACK#5203HiteshShonak wants to merge 2 commits intoboa-dev:mainfrom
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates Boa’s Fetch Request implementation to match the Fetch Standard by rejecting forbidden HTTP methods (CONNECT, TRACE, TRACK) in the Request constructor path, and adds regression tests to prevent the behavior from regressing.
Changes:
- Reject
CONNECT/TRACE/TRACK(case-insensitive) inRequestInit::into_request_builderby throwing aTypeError. - Add regression tests asserting
new Request(..., { method })throws for each forbidden method. - Add
indocusage in request tests for cleaner embedded JS snippets.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| core/runtime/src/fetch/request.rs | Adds forbidden-method validation during request builder construction, returning a TypeError for CONNECT/TRACE/TRACK. |
| core/runtime/src/fetch/tests/request.rs | Adds new tests ensuring Request construction throws when using forbidden methods. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Test262 conformance changes
Tested main commit: |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #5203 +/- ##
===========================================
+ Coverage 47.24% 59.81% +12.56%
===========================================
Files 476 582 +106
Lines 46892 63466 +16574
===========================================
+ Hits 22154 37961 +15807
- Misses 24738 25505 +767 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This Pull Request fixes/closes #5202.
It changes the following:
CONNECT,TRACE, andTRACKmethods in theRequestconstructor and throw aTypeError, matching the Fetch Standard.connect,trace,trackare also rejected.Testing:
cargo test -p boa_runtime request -- --nocaptureSpec reference: https://fetch.spec.whatwg.org/#forbidden-method