[wrangler] cloudchamber curl truncates header values containing a colon, and crashes on headers with none

[chinesepowered]

What versions & operating system are you using?

Wrangler 4.114.0, Node v24.11.0, macOS 15 (Darwin 24.6.0). Also present on main @ 3a141ed11.

Please provide a link to a minimal reproduction

No repo needed — reproduced directly from the CLI, commands included below.

Describe the Bug

wrangler cloudchamber curl mis-parses the --header flag in two ways, both caused by splitting the header on every colon and keeping only the segment between the first and second:

// packages/wrangler/src/cloudchamber/curl.ts
const headers: Record<string, string> = (args.header ?? []).reduce(
    (prev, now) => ({
        ...prev,
        [now.toString().split(":")[0].trim()]: now
            .toString()
            .split(":")[1]          // <-- only the segment before the SECOND colon
            .trim(),
    }),
    { "coordinator-request-id": requestId }
);

1. Header values containing a colon are silently truncated.

wrangler cloudchamber curl /test --header "location:https://example.com/a:b"

The header is sent as location: https — everything from the second colon onward is dropped. This affects any value with a colon in it, which includes URLs, timestamps, and Authorization: Bearer style values with encoded content.

2. A header with no colon crashes the command.

wrangler cloudchamber curl /test --header "invalid"

"invalid".split(":")[1] is undefined, so .trim() throws:

TypeError: Cannot read properties of undefined (reading 'trim')

Expected: split on the first colon only — the standard rule for HTTP header parsing (RFC 9110 §5.1: the field name is everything before the first colon, the value is the remainder). A header with no colon should produce a clear user-facing error rather than an unhandled TypeError.

Please provide any relevant error logs

TypeError: Cannot read properties of undefined (reading 'trim')
    at packages/wrangler/src/cloudchamber/curl.ts

[workers-devprod]

Note

This is an automated, advisory triage report generated by workers-devprod. It is not an official maintainer response — a maintainer will follow up.

🤖 Automated triage report

Issue Triage: #14827

Summary

wrangler cloudchamber curl mis-parses the --header flag: it splits on every colon and keeps only the first value segment, truncating header values that contain a colon and crashing with a TypeError when a header has no colon.

Classification

• Type: Bug
• Component: packages/wrangler (cloudchamber curl command — src/cloudchamber/curl.ts)
• Severity: Medium
• Has Reproduction: Yes (CLI commands provided; no repo required)
• Quality: Complete

Findings

• Created: not available (issue metadata truncated in context.json)
• Author: chinesepowered
• Version: Wrangler 4.114.0, Node v24.11.0, macOS 15 (Darwin 24.6.0); also reproduced on main @ 3a141ed11
• Labels: not available (metadata truncated)
• Comments: not available (metadata truncated)

Analysis

• Root cause is precisely identified: now.toString().split(":")[1] in packages/wrangler/src/cloudchamber/curl.ts takes only the segment between the first and second colon, discarding the rest of the value and throwing when no colon is present.
• Two concrete, distinct failure modes with runnable reproductions: (1) silent truncation of header values containing colons (URLs, timestamps, Authorization: Bearer payloads), and (2) an unhandled TypeError: Cannot read properties of undefined (reading 'trim') for a header with no colon.
• The expected behavior is well-specified and standards-backed (RFC 9110 §5.1: split on the first colon only; field name before, value after).
• The fix is small and self-contained — split on the first colon (e.g. split(":") with a limit / index-based slice) and add a clear user-facing error for malformed headers instead of crashing. This is a good easy/low-risk fix.
• Note: the cloudchamber source (packages/wrangler/src/cloudchamber/curl.ts) was not present in this checkout, so the fix could not be verified against current source here; the analysis relies on the code snippet quoted in the issue.

Recommendation

Status: KEEP OPEN

Reasoning: This is a well-scoped, reproducible bug with a clearly identified root cause and standards-based expected behavior. It is a legitimate defect in wrangler's cloudchamber curl header parsing and warrants a fix.

Action: Accept the bug and fix curl.ts to split each --header on the first colon only, and emit a clear error for headers without a colon rather than throwing an unhandled TypeError. Add regression tests covering (a) a value containing colons and (b) a header with no colon. A changeset (patch) is required.

Suggested Labels: bug

Suggested Comment

Thanks for the detailed report and root-cause analysis — this is a clear bug. The header parsing in cloudchamber curl splits on every colon and keeps only the segment before the second one, which truncates any value containing a colon and throws when a header has no colon at all. It should split on the first colon only (field name before, value after) and surface a clear error for a malformed header instead of crashing. We'll get a fix in.

Structured summary (JSON)

{
  "issueNumber": 14827,
  "title": "wrangler cloudchamber curl mis-parses the --header flag (truncates values with colons; crashes on headers without a colon)",
  "githubUrl": "https://github.com/cloudflare/workers-sdk/issues/14827",
  "recommendation": "KEEP OPEN",
  "difficulty": "easy",
  "reasoning": "Well-scoped, reproducible bug with a precisely identified root cause in packages/wrangler/src/cloudchamber/curl.ts and standards-based expected behavior (RFC 9110: split on first colon only).",
  "suggestedAction": "Fix curl.ts to split each --header on the first colon only and emit a clear error for headers without a colon; add regression tests and a patch changeset.",
  "hasSuggestedComment": true,
  "suggestedLabels": ["bug"]
}

[Tchirek]

Hi! I dug into this and have a focused fix ready locally. It splits each header at the first colon, validates missing or empty names before the request error handler, and adds coverage for colon-containing values, empty values, and malformed headers. Happy to open the PR if that direction looks good.

[chinesepowered]

For reference while #14829 is under review: I had the same fix up as #14815 before filing this issue — it was closed for not having an issue attached, which is what prompted the report. It takes the same split-on-first-colon approach, and its tests cover multi-colon values, empty values, and headers with no separator, so it may be useful as a cross-check on edge cases. No objection to #14829 landing instead.