[wrangler] cloudchamber curl truncates header values containing a colon, and crashes on headers with none

[chinesepowered]

What versions & operating system are you using?

Wrangler 4.114.0, Node v24.11.0, macOS 15 (Darwin 24.6.0). Also present on main @ 3a141ed11.

Please provide a link to a minimal reproduction

No repo needed — reproduced directly from the CLI, commands included below.

Describe the Bug

wrangler cloudchamber curl mis-parses the --header flag in two ways, both caused by splitting the header on every colon and keeping only the segment between the first and second:

// packages/wrangler/src/cloudchamber/curl.ts
const headers: Record<string, string> = (args.header ?? []).reduce(
    (prev, now) => ({
        ...prev,
        [now.toString().split(":")[0].trim()]: now
            .toString()
            .split(":")[1]          // <-- only the segment before the SECOND colon
            .trim(),
    }),
    { "coordinator-request-id": requestId }
);

1. Header values containing a colon are silently truncated.

wrangler cloudchamber curl /test --header "location:https://example.com/a:b"

The header is sent as location: https — everything from the second colon onward is dropped. This affects any value with a colon in it, which includes URLs, timestamps, and Authorization: Bearer style values with encoded content.

2. A header with no colon crashes the command.

wrangler cloudchamber curl /test --header "invalid"

"invalid".split(":")[1] is undefined, so .trim() throws:

TypeError: Cannot read properties of undefined (reading 'trim')

Expected: split on the first colon only — the standard rule for HTTP header parsing (RFC 9110 §5.1: the field name is everything before the first colon, the value is the remainder). A header with no colon should produce a clear user-facing error rather than an unhandled TypeError.

Please provide any relevant error logs

TypeError: Cannot read properties of undefined (reading 'trim')
    at packages/wrangler/src/cloudchamber/curl.ts

[workers-devprod]

Note

This is an automated, advisory triage report generated by workers-devprod. It is not an official maintainer response — a maintainer will follow up.

🤖 Automated triage report

Issue Triage: #14827

Summary

wrangler cloudchamber curl mis-parses the --header flag: it splits header strings on every colon (keeping only the segment between the first and second colon), which truncates values containing colons and throws an unhandled TypeError for headers with no colon.

Classification

• Type: Bug
• Component: packages/wrangler (cloudchamber / containers — src/cloudchamber/curl.ts)
• Severity: Medium
• Has Reproduction: Yes (CLI commands provided; no repo needed)
• Quality: Complete

Findings

• Created: not available in provided context (body truncated at metadata)
• Author: chinesepowered
• Version: Wrangler 4.114.0, Node v24.11.0, macOS 15 (Darwin 24.6.0); also reproduces on main @ 3a141ed11
• Labels: not available in provided context
• Comments: not available in provided context

Analysis

• The report pinpoints the exact source location (packages/wrangler/src/cloudchamber/curl.ts) and quotes the offending reduce block that does split(":")[0] for the name and split(":")[1] for the value.
• Two distinct, correct failure modes are demonstrated: (1) values with a colon (URLs, timestamps, Authorization: Bearer payloads) are silently truncated at the second colon; (2) a header with no colon makes split(":")[1] undefined, so .trim() throws TypeError: Cannot read properties of undefined (reading 'trim').
• The expected behavior is well-justified — split on the first colon only (RFC 9110 §5.1), and surface a clear user-facing error for a malformed header instead of an unhandled TypeError.
• Fix is small and self-contained: use the index of the first : to split name/value, and validate that a colon is present. Low risk, easy difficulty.
• Note: this checkout is a metadata-only workspace (no packages/ directory), so the source file could not be verified directly; the assessment relies on the quoted code and reproduction steps in the issue.

Recommendation

Status: KEEP OPEN

Reasoning: This is a genuine, well-specified bug in Wrangler's cloudchamber curl command with a clear root cause, reliable reproduction, and confirmation that it reproduces on main. It is a good, low-risk fix candidate.

Action: Route to the Wrangler / containers team. Change the header parsing in src/cloudchamber/curl.ts to split on the first colon only and emit a clear UserError when a header string contains no colon. Add unit tests for a value containing a colon and for a colon-less header.

Suggested Labels: none (label set unavailable in provided context; omitting rather than guessing)

Suggested Comment

Thanks for the detailed report and root-cause analysis — this is a real bug. The --header parsing in cloudchamber curl should split on the first colon only (per RFC 9110 §5.1) so values containing colons aren't truncated, and it should return a clear error instead of throwing a TypeError when a header has no colon. We'll get this fixed.

Structured summary (JSON)

{
  "issueNumber": 14827,
  "title": "wrangler cloudchamber curl mis-parses the --header flag (truncates values with colons, crashes on colon-less headers)",
  "githubUrl": "https://github.com/cloudflare/workers-sdk/issues/14827",
  "recommendation": "KEEP OPEN",
  "difficulty": "easy",
  "reasoning": "Well-specified, reproducible bug in cloudchamber curl header parsing with a clear root cause; splitting on every colon truncates values with colons and throws a TypeError for colon-less headers.",
  "suggestedAction": "Route to the Wrangler/containers team; fix src/cloudchamber/curl.ts to split header strings on the first colon only and error clearly on missing colon, with unit tests.",
  "hasSuggestedComment": true,
  "suggestedLabels": []
}

[Tchirek]

Hi! I dug into this and have a focused fix ready locally. It splits each header at the first colon, validates missing or empty names before the request error handler, and adds coverage for colon-containing values, empty values, and malformed headers. Happy to open the PR if that direction looks good.

[chinesepowered]

For reference while #14829 is under review: I had the same fix up as #14815 before filing this issue — it was closed for not having an issue attached, which is what prompted the report. It takes the same split-on-first-colon approach, and its tests cover multi-colon values, empty values, and headers with no separator, so it may be useful as a cross-check on edge cases. No objection to #14829 landing instead.

[NuroDev]

Fixed in #14815