Local server request and path safety contract

Documents the no-crate loopback server’s listener, method and request limits, path normalization, percent decoding, content types, and production exclusions.

Experimental
Last verified
2026-06-25 00:00 UTC
Updated
Reading time
2 minutes

Documents the no-crate loopback server’s listener, method and request limits, path normalization, percent decoding, content types, and production exclusions.

Implementation evidence: this topic is grounded in the reviewed GGUF.MiRust.com source snapshot. It documents observed code and artifacts without claiming broad deployment, model quality, or production readiness.

Listener

The Rust server defaults to root tinyrustlm, port 8080, and binds to 127.0.0.1. It accepts GET and HEAD only.

Request boundary

Request headers are read into a fixed 8,192-byte buffer. The parser validates the request line and rejects unsupported methods.

Path boundary

Percent decoding is explicit. Resolved components reject parent traversal, absolute prefixes, and paths that escape the canonical root. Directory targets resolve to index.html.

Serving boundary

Content types include HTML, CSS, JavaScript, WASM, SLM, JSON/manifest, Markdown, and common image types. This is a local development tool, not a TLS, caching, compression, range-request, CSP, or production server.

Scope

This starter page defines the questions, boundaries, evidence, and failure modes that should be recorded before a capability is presented as supported.

Engineering considerations

  • Identify the source, version, target environment, and owner.
  • Separate observed values from estimates and externally reported values.
  • Record trade-offs, unsupported cases, and fallback behavior.
  • Link performance statements to a compatible benchmark methodology.

Verification questions

  • What exact artifact, revision, backend, and environment were reviewed?
  • Which assumptions could change the result?
  • Which data should be retained so another engineer can reproduce the conclusion?