[Test Suite]: request() POST body nil when body exceeds certain character length.

[wirlypirly12]

Issue Type

Test falsely passes incorrect behaviour

Affected Function or Area

request

Issue Summary

sUNC should be testing the request functions POST capabilities. This wouldn't need to be done if everyone implemented their networking right but we don't live in that reality sadly.

The issue:
A couple of executors lack the capability of handling "long" (~500 characters) bodies inside the response from the targeted backend. This causes instability inside of scripts that use heavy encryption.

Current Test Behaviour

The test currently passes with no issue.

Expected Behaviour

What should come from this script is that the response from httpbin.org mirrors the post request 1:1, this on some executors is not the case and the body will get removed from the request response entirely.

Reproduction Steps

local r = request{
  Url = "https://httpbin.org/post",
  Method = "POST",
  Body = game:GetService("HttpService"):JSONEncode{
    string.rep("a", 500)
  }
}
table.foreach(r, print)

Additional Context

The executors I know have these issues are Opiumware and Wave

[Richy-Z]

Thanks for reporting this issue. Within the context of requests, 500 byte response bodies aren't even that big, so it's actually quite concerning that some executors might just omit the response entirely. I'll look into how we test request and see if we can improve it to catch implementations where this seems to be the case.

[wirlypirly12]

Thank you @Richy-Z , this has been an ongoing issue for months now and has been reported by their users multiple times. This was a last resort since most exploits only cares about their sUNC score.

[Richy-Z]

Just wrote a quick test, could you run this on both executors please? the purpose of this is to narrow down whether this is unique only to POST requests or just to all requests in general.

local HttpService = game:GetService("HttpService")

local methods = { "DELETE", "PATCH", "POST", "PUT" }

local function random(length)
	local chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
	local out = {}

	for i = 1, length do
		local index = math.random(1, #chars)
		out[i] = string.sub(chars, index, index)
	end

	return table.concat(out)
end

local function p(tebel, indent)
	indent = indent or ""

	for k, v in pairs(tebel) do
		if type(v) == "table" then
			print(indent .. tostring(k) .. ":")
			p(v, indent .. "  ")
		else
			print(indent .. tostring(k), v)
		end
	end
end

math.randomseed(os.clock() * 1000000)

for _, method in pairs(methods) do
	local body = random(8192)

	local r = request({
		Url = "https://httpbin.org/" .. string.lower(method),
		Method = method,
		Headers = {
			["Content-Type"] = "text/plain"
		},
		Body = body
	})

	local passed = false
	local decoded

	local ok, result = pcall(function()
		return HttpService:JSONDecode(r.Body)
	end)

	if ok then
		decoded = result

		if decoded.data == body then
			passed = true
		end
	end

	if not passed then
		print("didnt pass method:", method)

		print("response table:")
		p(r)

		if decoded then
			print("decoded response body:")
			p(decoded)
		else
			print("failed to parse response body as json")
		end
	end
end

[norbyv1]

I can't replicate the issue on Opiumware (perhaps it's been fixed in a previous update) when was the last time you tested this?
@wirlypirly12

[Richy-Z]

@norbyv1 out of interest, could you run the script above on opiumware and show me the result? ofc blurring/blocking the ip address in the response (if any). thanks

[norbyv1]

@Richy-Z
There's no output if successful but these are the request results

https://rubis.app/view/?scrap=theX0QUfHVtSyAIL

[Richy-Z]

@norbyv1 Thanks. All looks good.