Skip to content

fix(webserver): reset _contentLength after _streamFileCore send#12385

Merged
me-no-dev merged 4 commits into
espressif:masterfrom
Sick-E:master
Feb 25, 2026
Merged

fix(webserver): reset _contentLength after _streamFileCore send#12385
me-no-dev merged 4 commits into
espressif:masterfrom
Sick-E:master

Conversation

@Sick-E
Copy link
Copy Markdown
Contributor

@Sick-E Sick-E commented Feb 21, 2026

Description of Change

_streamFileCore calls setContentLength(fileSize) before send(), which sets the member variable _contentLength to the file size. After send() completes, _contentLength is never reset, causing it to leak into subsequent response handlers. Any handler calling send() after a streamFile response will incorrectly inherit the previous file's size as Content-Length, resulting in ERR_CONTENT_LENGTH_MISMATCH in the browser.

Fix: reset _contentLength to CONTENT_LENGTH_NOT_SET at the end of _streamFileCore.

Test Scenarios

Tested on ESP32 with framework-arduinoespressif32 via PlatformIO.

Reproduction scenario:

  1. HTML page with <link rel="icon"> pointing to a file served via streamFile
  2. On page load, browser automatically fetches favicon via GET — _contentLength is set to favicon file size
  3. Subsequent POST request handler calls send(200, "text/plain", "Success") without explicitly calling setContentLength
  4. Response incorrectly contains Content-Length equal to favicon size → ERR_CONTENT_LENGTH_MISMATCH

After fix: _contentLength is reset after each streamFile response, subsequent handlers receive correct Content-Length.

Related links

None

After calling send() in _streamFileCore, _contentLength retained the
file size value and was incorrectly reused in subsequent response
handlers, causing ERR_CONTENT_LENGTH_MISMATCH in the browser.

Reset _contentLength to CONTENT_LENGTH_NOT_SET after send() to prevent
leaking file size into unrelated responses.
@Sick-E Sick-E requested a review from a team as a code owner February 21, 2026 19:34
@CLAassistant
Copy link
Copy Markdown

CLAassistant commented Feb 21, 2026

CLA assistant check
All committers have signed the CLA.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Feb 21, 2026

Warnings
⚠️

Some issues found for the commit messages in this PR:

  • the commit message "Commit message (subject):":
    • body's lines must not be longer than 100 characters
    • summary looks empty
    • type/action looks empty
    • body must have leading blank line
  • the commit message "fix(WebServer): reset _contentLength after _streamFileCore send":
    • scope/component should be lowercase without whitespace, allowed special characters are _ / . , * - .

Please fix these commit messages - here are some basic tips:

  • follow Conventional Commits style
  • correct format of commit message should be: <type/action>(<scope/component>): <summary>, for example fix(esp32): Fixed startup timeout issue
  • allowed types are: change,ci,docs,feat,fix,refactor,remove,revert,test
  • sufficiently descriptive message summary should be between 10 to 72 characters and start with upper case letter
  • avoid Jira references in commit messages (unavailable/irrelevant for our customers)

TIP: Install pre-commit hooks and run this check when committing (uses the Conventional Precommit Linter).

👋 Hello Sick-E, we appreciate your contribution to this project!


📘 Please review the project's Contributions Guide for key guidelines on code, documentation, testing, and more.

🖊️ Please also make sure you have read and signed the Contributor License Agreement for this project.

Click to see more instructions ...


This automated output is generated by the PR linter DangerJS, which checks if your Pull Request meets the project's requirements and helps you fix potential issues.

DangerJS is triggered with each push event to a Pull Request and modify the contents of this comment.

Please consider the following:
- Danger mainly focuses on the PR structure and formatting and can't understand the meaning behind your code or changes.
- Danger is not a substitute for human code reviews; it's still important to request a code review from your colleagues.
- Resolve all warnings (⚠️ ) before requesting a review from human reviewers - they will appreciate it.
- To manually retry these Danger checks, please navigate to the Actions tab and re-run last Danger workflow.

Review and merge process you can expect ...


We do welcome contributions in the form of bug reports, feature requests and pull requests.

1. An internal issue has been created for the PR, we assign it to the relevant engineer.
2. They review the PR and either approve it or ask you for changes or clarifications.
3. Once the GitHub PR is approved we do the final review, collect approvals from core owners and make sure all the automated tests are passing.
- At this point we may do some adjustments to the proposed change, or extend it by adding tests or documentation.
4. If the change is approved and passes the tests it is merged into the default branch.

Generated by 🚫 dangerJS against 9123263

@lucasssvaz lucasssvaz requested a review from me-no-dev February 21, 2026 19:53
Comment thread .gitignore Outdated
Move .idea/ to IDE section in .gitignore

Description (body):
Relocated .idea/ entry from the bottom of the file to the IDE-related section alongside .vscode/ and .vs/.
@Sick-E Sick-E changed the title fix(WebServer): reset _contentLength after _streamFileCore send fix(webserver): reset _contentLength after _streamFileCore send Feb 21, 2026
@lucasssvaz lucasssvaz requested a review from Copilot February 22, 2026 03:34
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request fixes a bug where the _contentLength member variable in the WebServer class was leaking between requests. When _streamFileCore served a file, it set _contentLength to the file size but never reset it, causing subsequent request handlers to inherit this value. This resulted in ERR_CONTENT_LENGTH_MISMATCH errors in browsers.

Changes:

  • Adds a resetContentLength() method to reset _contentLength to CONTENT_LENGTH_NOT_SET
  • Calls resetContentLength() at the end of _streamFileCore() to prevent content length leakage
  • Updates .gitignore to include /.idea/ directory for JetBrains IDEs

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File Description
libraries/WebServer/src/WebServer.cpp Implements resetContentLength() method and calls it after send() in _streamFileCore() to fix content length leakage bug
.gitignore Adds /.idea/ to ignore JetBrains IDE files and updates comment to reflect support for additional IDEs

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread libraries/WebServer/src/WebServer.cpp Outdated
…_streamFileCore

Description (body):
Replaced dedicated resetContentLength() method with a direct call to
setContentLength(CONTENT_LENGTH_NOT_SET) at the end of _streamFileCore,
reusing existing API without requiring a new declaration in WebServer.h.
@github-actions
Copy link
Copy Markdown
Contributor

Memory usage test (comparing PR against master branch)

The table below shows the summary of memory usage change (decrease - increase) in bytes and percentage for each target.

MemoryFLASH [bytes]FLASH [%]RAM [bytes]RAM [%]
TargetDECINCDECINCDECINCDECINC
ESP320⚠️ +40.000.00000.000.00
ESP32C30⚠️ +60.000.00000.000.00
ESP32C50⚠️ +60.000.00000.000.00
ESP32C60⚠️ +60.000.00000.000.00
ESP32P40⚠️ +60.000.00000.000.00
ESP32S20⚠️ +40.000.00000.000.00
ESP32S30⚠️ +40.000.00000.000.00
Click to expand the detailed deltas report [usage change in BYTES]
TargetESP32ESP32C3ESP32C5ESP32C6ESP32P4ESP32S2ESP32S3
ExampleFLASHRAMFLASHRAMFLASHRAMFLASHRAMFLASHRAMFLASHRAMFLASHRAM
libraries/DNSServer/examples/CaptivePortal00000000000000
libraries/HTTPUpdateServer/examples/WebUpdater00000000000000
libraries/Update/examples/HTTP_Server_AES_OTA_Update00000000000000
libraries/Update/examples/OTAWebUpdater00000000000000
libraries/WebServer/examples/AdvancedWebServer00000000000000
libraries/WebServer/examples/ChunkWriting00000000000000
libraries/WebServer/examples/FSBrowser⚠️ +40⚠️ +60⚠️ +60⚠️ +60⚠️ +60⚠️ +40⚠️ +40
libraries/WebServer/examples/Filters00000000000000
libraries/WebServer/examples/HelloServer00000000000000
libraries/WebServer/examples/HttpAdvancedAuth00000000000000
libraries/WebServer/examples/HttpAuthCallback00000000000000
libraries/WebServer/examples/HttpAuthCallbackInline00000000000000
libraries/WebServer/examples/HttpBasicAuth00000000000000
libraries/WebServer/examples/HttpBasicAuthSHA100000000000000
libraries/WebServer/examples/HttpBasicAuthSHA1orBearerToken00000000000000
libraries/WebServer/examples/Middleware00000000--0000
libraries/WebServer/examples/MultiHomedServers00000000000000
libraries/WebServer/examples/PathArgServer00000000000000
libraries/WebServer/examples/SDWebServer⚠️ +40⚠️ +60⚠️ +60⚠️ +60⚠️ +60⚠️ +40⚠️ +40
libraries/WebServer/examples/SimpleAuthentification00000000000000
libraries/WebServer/examples/UploadHugeFile00000000000000
libraries/WebServer/examples/WebServer⚠️ +40⚠️ +60⚠️ +60⚠️ +60⚠️ +60⚠️ +40⚠️ +40
libraries/WebServer/examples/WebUpdate00000000000000

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Feb 23, 2026

Test Results

 91 files   91 suites   30m 53s ⏱️
 67 tests  67 ✅ 0 💤 0 ❌
684 runs  684 ✅ 0 💤 0 ❌

Results for commit 9123263.

♻️ This comment has been updated with latest results.

@lucasssvaz lucasssvaz added Area: Libraries Issue is related to Library support. Status: Pending Merge Pull Request is ready to be merged labels Feb 24, 2026
@me-no-dev me-no-dev merged commit 78ad5ec into espressif:master Feb 25, 2026
90 of 100 checks passed
bittoby pushed a commit to bittoby/arduino-esp32 that referenced this pull request Feb 27, 2026
…essif#12385)

* fix(WebServer): reset _contentLength after _streamFileCore send

After calling send() in _streamFileCore, _contentLength retained the
file size value and was incorrectly reused in subsequent response
handlers, causing ERR_CONTENT_LENGTH_MISMATCH in the browser.

Reset _contentLength to CONTENT_LENGTH_NOT_SET after send() to prevent
leaking file size into unrelated responses.

* Commit message (subject):
Move .idea/ to IDE section in .gitignore

Description (body):
Relocated .idea/ entry from the bottom of the file to the IDE-related section alongside .vscode/ and .vs/.

* fix(webserver): reset _contentLength to CONTENT_LENGTH_NOT_SET after _streamFileCore

Description (body):
Replaced dedicated resetContentLength() method with a direct call to
setContentLength(CONTENT_LENGTH_NOT_SET) at the end of _streamFileCore,
reusing existing API without requiring a new declaration in WebServer.h.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Area: Libraries Issue is related to Library support. Status: Pending Merge Pull Request is ready to be merged

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants