[rishabh-gupta-hashicorp]

Description

An invalid ?max_stale= value is echoed back in the 400 error (Invalid max_stale value "<input>") without an explicit Content-Type. If an operator sets Content-Type through http_config.response_headers (for example text/html), that header is applied to this response, so the browser renders the reflected input as HTML (reflected XSS).

This sets Content-Type: text/plain; charset=utf-8 on that error response before it is written, matching the other error paths in wrap() (#21704). Valid requests are unaffected.

Testing & Reproduction steps

Reproduce:

1. Start an agent with http_config { response_headers { "Content-Type" = "text/html" } }.
2. Open /v1/catalog/nodes?max_stale=<img src=x onerror=alert(1)> in a browser.
3. Before this change the response is text/html and the script runs. After it, the response is text/plain and the payload is shown as text.

Tests:

• Added TestParseConsistency_InvalidMaxStaleContentType.
• go test ./agent/ -run 'TestParseConsistency_InvalidMaxStaleContentType$' -count=1: fails without the fix (actual: "text/html"), passes with it.
• go test ./agent/ -run 'TestParseConsistency|TestErrorContentTypeHeaderSet$|TestHTTPAPIResponseHeaders$|TestHTTPAPIValidateContentTypeHeaders$|TestUIResponseHeaders$|TestContentTypeIsJSON$' -count=1: passed.
• go vet ./agent/: passed.

Links

• Related: [Security] Fix XSS Vulnerability where content-type header wasn't explicitly set #21704 (explicit Content-Type on error responses)

PR Checklist

• updated test coverage
• external facing docs updated
• appropriate backport labels added
• not a security concern

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.

• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.

• If applicable, I've documented the impact of any changes to security controls.

  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

[github-actions]

Go Test Coverage: 67.0%

Patch coverage: 100.0% (1/1 changed lines covered)

See the workflow run for the full per-package breakdown and downloadable HTML report.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.22%. Comparing base (da3684f) to head (a5cd35f).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #24071      +/-   ##
==========================================
+ Coverage   56.64%   62.22%   +5.58%     
==========================================
  Files        1068     1060       -8     
  Lines      129948   129338     -610     
==========================================
+ Hits        73612    80484    +6872     
+ Misses      49554    41383    -8171     
- Partials     6782     7471     +689     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.