RocketChat / RocketChat/Rocket.Chat

Backend [avatar]: Content-Length header is violently stripped when avatar file size is zero

Open
#39,187 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

type: bug
Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Bug Description

When Rocket.Chat serves avatar image files, it determines the file's HTTP headers based on internal metadata. However, an incorrect truthy check on the file's size results in the Content-Length header being stripped completely if the file size evaluates to 0 bytes.

Steps to Reproduce

  1. The server receives a request for an avatar.
  2. The avatar utility identifies a corresponding file reference, but it happens to have a size of 0 bytes (e.g., an empty file due to sync issues, intentional placeholder overrides, or zero-byte cache objects).
  3. The server executes apps/meteor/server/routes/avatar/utils.ts around line 43:
if (file.size) { // 0 evaluates to false
	res.setHeader('Content-Length', file.size);
}
  1. Because 0 is falsy in Javascript, the Content-Length header is entirely omitted from the HTTP response.

Expected: The system should recognize 0 as a valid file size and explicitly set Content-Length: 0 on the HTTP response, which is crucial for proxy servers, CDNs, and client apps to properly terminate the reading stream.
Actual: The header is omitted, leading to potentially hanging requests or invalid HTTP spec adherence.

Environment

  • Rocket.Chat version: Develop branch (latest)

Possible Fix

Explicitly verify that size is a defined number instead of relying on weak truthy evaluation:

if (typeof file.size === 'number') {
	res.setHeader('Content-Length', file.size);
}

Additional Context

I discovered this via static code analysis while hunting for weak Javascript truthiness checks across the backend. Missing a Content-Length for a 0 payload violates strict HTTP implementations. I am preparing a simple PR to strengthen this type check.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in apps/meteor/server/routes/avatar/utils.ts around line 43, where the avatar response sets the Content-Length header from file.size. Verify the zero-byte case and ensure the completed behavior preserves Content-Length: 0 when the file size is zero.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, backend
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.