Daniel Sutton 343fde250c fix(webapp): apply streaming content-type bypass on patchedEnd too ...

patchedWrite checks isStreamingContentType() before buffering; patchedEnd
only had the headersSent half. A 5xx response that sets a streaming
content-type and delivers its body via single-call res.end(chunk) would
get buffered, UTF-8 decoded, and run through the leak regex — wrong
shape for binary/SSE payloads. Mirrors the patchedWrite guard so the
same bypass applies regardless of write/end call shape.

Test pins the contract: a 5xx octet-stream body whose bytes contain
"P1001" passes through unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-21 11:11:55 +01:00

..

coordinator

fix(ci): fix docker image publishing and worker builds (#3013)

2026-02-06 13:56:39 +00:00

docker-provider

fix(ci): fix docker image publishing and worker builds (#3013)

2026-02-06 13:56:39 +00:00

kubernetes-provider

fix(ci): fix docker image publishing and worker builds (#3013)

2026-02-06 13:56:39 +00:00

supervisor

chore: upgrade pnpm to 10.33.2 with security hardening (#3489)

2026-05-01 16:24:26 +01:00

webapp

fix(webapp): apply streaming content-type bypass on patchedEnd too

2026-05-21 11:11:55 +01:00