Repository navigation
perf(people): reject k6-collapsed duplicate Content-Type values #388
Description
Finding
Fresh audit of Draft #317 after #387 found a transport ambiguity below the current header-map cardinality check.
Pinned Grafana k6 v2.2.0 exposes response headers as map[string]string. In lib/netext/httpext/request.go, k6 converts Go http.Header to that map with strings.Join(vs, ", "). Repeated wire-level Content-Type field-lines with the same canonical name are therefore collapsed into one string before the workload sees response.headers.
The current #317 media-type validator then extracts the media type with value.split(";", 1)[0]. A collapsed value such as:
application/json; charset=utf-8, text/plain
is consequently accepted as application/json, even though it represents multiple conflicting Content-Type values after k6 normalization. This is a commercial-evidence false-GREEN: object-key cardinality alone does not prove one wire-level representation when the pinned client has already collapsed repeated values.
Required repair
Test first, then minimally:
- add a regression proving a k6-collapsed conflicting value such as
application/json; charset=utf-8, text/plainfails closed; - reject unquoted list ambiguity before extracting the media type or parameters;
- preserve a legal quoted parameter comma, so
application/json; profile="a,b"does not become a false-RED merely because a comma occurs inside a quoted-string; - reject malformed/unterminated quoted parameter syntax rather than allowing it to hide a joined second value;
- preserve perf(people): bind Employment-separation verdicts to JSON response media type #387 case-insensitive one-key handling, optional parameters, pinned k6
2.2.0, strict response-body parsing, and all success/conflict semantics; - do not broaden the change into a generic HTTP parser or change canonical People API/domain truth.
Keep this issue open through protected/integration acceptance; branch-local repair is not completion.
Activity
seonghobae commentedon Sep 15, 2026
Repair lineage is now explicit on Draft #317. Test-first
3eb5a05b13b6eb2b942ff9326cd5fb1fa2b75d15adds the k6-collapsed conflicting Content-Type, legal quoted-comma parameter, and unterminated-quote cases without changing the validator. The predecessor logic evaluates those three cases astrue,true,true, exposing two false-GREENs. Causal successor64a9e9ae093472ca3aabfbde48d17778d8f2dcecrejects unquoted comma/list ambiguity and unbalanced quoting before media-type extraction; the same focused inputs evaluatefalse,true,false. Pinned k6 v2.2.0 remains the runtime authority. No hosted workflow exists on this head, so this is focused logic evidence only; keep the issue open through protected/integration acceptance.seonghobae commentedon Sep 15, 2026
Follow-up hardening after the initial repair: test-first
842320cffa37d98c3ae474acc79f8e7c53411c6cadds escaped quoted-string, embedded malformed quote, and dangling-parameter cases. Current causal successorcac6fbf7652e5b3d976fc2439376aae47ac4e7edvalidates a single Content-Type representation asapplication/jsonplus syntactically valid token/quoted-string parameters, rejects unquoted comma/list ambiguity and malformed parameter syntax, and preserves quoted commas/escaped quotes. Fresh compare remains 0 behind canonical #64 with only the existing 42tests/performance/...files as child-owned delta. No hosted k6 or commercial latency evidence is claimed.seonghobae commentedon Sep 15, 2026
Standards cross-check for the final boundary: RFC 9110 §8.3 defines
Content-Type = media-type, explicitly notes that Content-Type is a singleton field and that incorrectly repeated field lines can be combined into an apparent list with interoperability/security risk. RFC 9110 §8.3.1 defines semicolon-delimited media-type parameters using token/quoted-string syntax; §5.6.6 notes no whitespace is allowed around=. RFC 6838 §4.3 says a specific media-type parameter name appearing more than once is an error. Test-first0de56e181da3a112b2a2a10072b37156b7425a38adds whitespace-around-=and case-insensitive duplicate-parameter rejection. Current successor4220c168f39fb46cc00ebd6b57be3622865cef75enforces both while retaining the k6-collapsed-list repair.