Description
The Sourcepoint proxy skips JavaScript and HTML body rewriting whenever the upstream response omits Content-Length.
Valid HTTP/2 and chunked responses commonly omit this header. Trusted Server therefore serves some eligible responses unchanged even when rewrite_sdk = true. Embedded Sourcepoint CDN URLs or root-relative privacy-manager assets can bypass the first-party proxy.
This is separate from the campaign/state behavior that can suppress the consent banner.
Current behavior
In crates/trusted-server-core/src/integrations/sourcepoint.rs, the proxy:
- Detects a successful JavaScript or HTML response.
- Reads
Content-Length.
- Passes through bodies larger than 5 MiB.
- Also passes through any body with no
Content-Length.
- Uses
collect_response_bounded only when the header exists and is within the limit.
The missing-header branch returns before the existing bounded collector can determine the actual body size.
A production browser audit observed two Sourcepoint get_site_data responses that:
- returned HTTP 200;
- used
application/javascript;
- omitted upstream
Content-Length; and
- triggered
reason: missing_content_length.
The captured bodies were only 208 bytes and contained no known URL or asset patterns requiring rewriting. This capture did not establish a user-visible failure, but it demonstrates the bypass.
Expected behavior
An eligible response should not bypass rewriting solely because Content-Length is absent.
Trusted Server should:
- collect unknown-length JavaScript and HTML bodies with the existing 5 MiB bound;
- rewrite bodies that complete within the limit;
- preserve current behavior for known-length bodies;
- define explicit behavior when an unknown-length body exceeds the limit; and
- retain bounded memory use on WASM targets.
The overflow behavior needs a deliberate choice. Returning an upstream/proxy error is simple and bounded but changes availability. Passing the original response through requires retaining the buffered prefix and streaming the remaining body without buffering it all.
Also verify whether /mms/v2/get_site_data should request Accept-Encoding: identity, since Sourcepoint currently returns it as JavaScript even though path classification does not treat it as a likely JavaScript resource.
Completion criteria
- A chunked or HTTP/2 JavaScript response below 5 MiB is rewritten without requiring
Content-Length.
- The same behavior is covered for HTML.
- Unknown-length bodies cannot cause unbounded buffering.
- Overflow behavior is tested and documented.
- Non-JavaScript and non-HTML responses remain streaming pass-throughs.
- Rewritten responses have correct
Content-Length, Content-Encoding, and cache headers.
- Tests cover Sourcepoint CDN URL rewriting and root-relative privacy-manager assets.
Related issues
Description
The Sourcepoint proxy skips JavaScript and HTML body rewriting whenever the upstream response omits
Content-Length.Valid HTTP/2 and chunked responses commonly omit this header. Trusted Server therefore serves some eligible responses unchanged even when
rewrite_sdk = true. Embedded Sourcepoint CDN URLs or root-relative privacy-manager assets can bypass the first-party proxy.This is separate from the campaign/state behavior that can suppress the consent banner.
Current behavior
In
crates/trusted-server-core/src/integrations/sourcepoint.rs, the proxy:Content-Length.Content-Length.collect_response_boundedonly when the header exists and is within the limit.The missing-header branch returns before the existing bounded collector can determine the actual body size.
A production browser audit observed two Sourcepoint
get_site_dataresponses that:application/javascript;Content-Length; andreason: missing_content_length.The captured bodies were only 208 bytes and contained no known URL or asset patterns requiring rewriting. This capture did not establish a user-visible failure, but it demonstrates the bypass.
Expected behavior
An eligible response should not bypass rewriting solely because
Content-Lengthis absent.Trusted Server should:
The overflow behavior needs a deliberate choice. Returning an upstream/proxy error is simple and bounded but changes availability. Passing the original response through requires retaining the buffered prefix and streaming the remaining body without buffering it all.
Also verify whether
/mms/v2/get_site_datashould requestAccept-Encoding: identity, since Sourcepoint currently returns it as JavaScript even though path classification does not treat it as a likely JavaScript resource.Completion criteria
Content-Length.Content-Length,Content-Encoding, and cache headers.Related issues