Answer 502 when an upstream sends an invalid status code

[ant-kurt]

What was wrong

When an upstream answered with a response head that Node's res.writeHead refuses (for example HTTP/1.1 099 x), the proxy's response callback threw RangeError [ERR_HTTP_INVALID_STATUS_CODE]. Nothing caught it, so the process running the proxy exited. Every connection through it was dropped, and the sandboxed command lost network access. Any upstream the sandbox is allowed to reach could trigger this. The defect is in the latest release, 0.0.78.

Fix

A new helper, relayResponseHead(res, upstreamRes) in src/sandbox/parent-proxy.ts, writes the upstream status and headers inside a try. All four relay sites now use it: the MITM-socket, parent-proxy and direct paths in http-proxy.ts, and the TLS-terminated path in tls-terminate-proxy.ts. If writeHead throws:

• the upstream response is destroyed and its body is not piped;
• if nothing has been sent to the client yet, any partly set headers are cleared and the client gets 502 Bad Gateway;
• if headers were already sent, the client response is destroyed.

Valid responses are relayed exactly as before. There is no API or configuration change. Opaque CONNECT tunnels are not affected.

Tests

test/sandbox/invalid-upstream-response.test.ts has two groups.

The relayResponseHead cases call the helper inside a real node:http server with a stub upstream, so they exercise the writeHead failure directly. Bun's writeHead throws on these heads just as Node's does. Status 99 and 1000, a control character in a header value, and an invalid header name each give the client a 502 with no upstream header, including one accepted before the rejected one. The upstream is destroyed and the helper returns false. If a head was already sent, the client response is cut off instead. A valid head is relayed. With the try/catch removed, the five failure cases fail.

The end-to-end cases send status 099 and 000 through the plain HTTP (direct) and TLS-terminated paths. Each checks that the client gets 502 with no upstream header or body bytes, and that a following normal request through the same proxy succeeds. Under Bun, which bun test uses, the HTTP client itself rejects these status lines, so these requests take the existing request-error path and never reach writeHead. They pin the 502 outcome and that the proxy keeps serving. The parent-proxy and MITM-socket paths have no end-to-end case. Under Node, the direct and parent-proxy paths were checked by hand: before this change the proxy crashes with Invalid status code: 99. After it, the client gets HTTP/1.1 502 Bad Gateway.

bun test test/sandbox/invalid-upstream-response.test.ts

---

Generated by Claude Code