fix(proxy): recompute Content-Length when repeat_request replaces the body

[Osamaali313]

Fixes #603

Problem

build_raw_request (strix/tools/proxy/caido_api.py) only auto-computes Content-Length when it is absent. So when repeat_request replaces the body (modifications={"body": ...}), the original request's stale Content-Length is carried over and sent — a server reading exactly that many bytes truncates the new body (or stalls), silently dropping the modified/injected payload. That defeats parameter-tampering / injection replays (the core use of the tool) and yields misleading negative results.

Reproduction

Original body "old" (Content-Length: 3); replacing it with a 37-byte body still sends Content-Length: 3.

Fix

In apply_modifications, when the body is replaced, drop any carried-over Content-Length (case-insensitively) so build_raw_request recomputes it — unless the caller explicitly set Content-Length in the same call's header modifications (preserves deliberate length-mismatch / smuggling tests).

Tests

Adds tests/test_proxy_caido_api.py: body replacement recomputes Content-Length; explicit override preserved; no-body modification leaves it untouched. Verified RED→GREEN on the real functions (3 passed).

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[greptile-apps]

Greptile Summary

This PR fixes a bug in apply_modifications where replacing the request body via repeat_request would leave behind the original request's stale Content-Length header, causing build_raw_request to silently forward the wrong length to the target server. The fix drops any carried-over Content-Length (case-insensitively) when the body is replaced, unless the caller explicitly sets Content-Length in the same modification call, and adds a new test file to verify the behavior.

• Core fix (caido_api.py): apply_modifications now strips stale Content-Length entries on body replacement; the existing build_raw_request recompute path handles filling in the correct value automatically.
• Explicit-override preservation: If the caller passes modifications={\"body\": ..., \"headers\": {\"Content-Length\": \"...\"}}, the explicit value is kept intact — enabling deliberate length-mismatch / request-smuggling tests.
• Tests (tests/test_proxy_caido_api.py): Three new tests cover the recompute path, the explicit-override path, and the no-body-modification path; the empty-body replacement case (body=\"\") is not yet covered and exposes a pre-existing gap in build_raw_request's if body guard.

Confidence Score: 4/5

Safe to merge for the common case; the fix correctly handles non-empty body replacement and explicit Content-Length overrides.

The fix is logically sound and the three new tests pass for the scenarios described in the PR. The only gap is the empty-body replacement path: build_raw_request skips adding Content-Length when the body string is falsy, so replacing a body with an empty string produces a raw POST with no Content-Length header at all. This is a narrow edge case and the behavior is no worse than before the PR, but it is an unverified code path.

strix/tools/proxy/caido_api.py line 160 and the corresponding test file would benefit from a follow-up to handle the empty-body replacement case.

Important Files Changed

Filename	Overview
strix/tools/proxy/caido_api.py	Adds stale Content-Length removal in apply_modifications when body is replaced; logic is correct for the non-empty body case but an empty-body replacement leaves the raw request with no Content-Length header
tests/test_proxy_caido_api.py	New test file covering body-replacement recompute, explicit-override preservation, and no-body-mod leave-untouched; missing a case for empty-string body replacement

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
tests/test_proxy_caido_api.py:14-28
**Missing test: empty-body replacement leaves no `Content-Length`**

The test suite covers the happy path (non-empty replacement) and the explicit-override path, but not the case where `modifications={"body": ""}`. `apply_modifications` will correctly drop the old `Content-Length`, but `build_raw_request` guards its recomputation with `if body and ...` (line 160 of `caido_api.py`), so an empty string is falsy and the header is never added back. The resulting raw POST request contains no `Content-Length` header at all — some servers will reject it or behave unexpectedly. A test and a fix in `build_raw_request` (changing the condition to `if body is not None and ...`) would close this gap.

_{Reviews (1): Last reviewed commit: "fix(proxy): recompute Content-Length whe..." | Re-trigger Greptile}

[greptile-apps]

Missing test: empty-body replacement leaves no Content-Length

The test suite covers the happy path (non-empty replacement) and the explicit-override path, but not the case where modifications={"body": ""}. apply_modifications will correctly drop the old Content-Length, but build_raw_request guards its recomputation with if body and ... (line 160 of caido_api.py), so an empty string is falsy and the header is never added back. The resulting raw POST request contains no Content-Length header at all — some servers will reject it or behave unexpectedly. A test and a fix in build_raw_request (changing the condition to if body is not None and ...) would close this gap.

Prompt To Fix With AI

This is a comment left during a code review.
Path: tests/test_proxy_caido_api.py
Line: 14-28

Comment:
**Missing test: empty-body replacement leaves no `Content-Length`**

The test suite covers the happy path (non-empty replacement) and the explicit-override path, but not the case where `modifications={"body": ""}`. `apply_modifications` will correctly drop the old `Content-Length`, but `build_raw_request` guards its recomputation with `if body and ...` (line 160 of `caido_api.py`), so an empty string is falsy and the header is never added back. The resulting raw POST request contains no `Content-Length` header at all — some servers will reject it or behave unexpectedly. A test and a fix in `build_raw_request` (changing the condition to `if body is not None and ...`) would close this gap.

How can I resolve this? If you propose a fix, please make it concise.

[Osamaali313]

Good catch — fixed in cd415e7. An empty replacement body now gets Content-Length: 0 set explicitly in apply_modifications, with a test.

I scoped it to the body-replacement path rather than changing build_raw_request's if body guard to if body is not None: the broader change would also attach Content-Length: 0 to genuinely body-less requests (e.g. replayed GETs that had no Content-Length originally), which would reduce replay fidelity — something a proxy used for security testing should avoid. Happy to switch to the guard change instead if you'd prefer it.