Indeed. The header reads to me as “the server says this content length will be…” so I have always taken precautions with it. Servers can be wrong as well as malicious.

Yep I’m surprised this made it through even basic code review. It makes it seem like this code was written by a junior dev without any code review. Accidents happen; it’s human and understandable; but wowzer this one seems like a beginner level mistake.