pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-09-17 20:32:25 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): escape the raw control bytes #13758 left in the provider-test sanitizer

Browse Source 
The `sanitizeUpstreamBodyText` character class carried a literal NUL (0x00) and a
literal 0x1f instead of the `\x00-\x1f` escapes. The regex behaved identically at
runtime, but a raw NUL in tracked source trips
tests/unit/source-no-raw-nul-bytes.test.ts, which reddens the Unit Tests fast-path (1/4)
shard for every PR opened against release/v3.8.51.

Refs #12958
This commit is contained in:
diegosouzapw
2026-09-16 12:52:26 -03:00
parent 9d9284417c
commit 4697a0873d
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
changelog.d/fixes/13758-raw-nul-byte-provider-test-route.md Normal file
View File

@@ -0,0 +1,5 @@
Replaced the raw control bytes that #13758 left inside the `sanitizeUpstreamBodyText`
character class in `src/app/api/providers/[id]/test/route.ts` with their `\x00-\x1f`
escapes. The range was byte-identical at runtime, but the literal NUL in the source broke
`tests/unit/source-no-raw-nul-bytes.test.ts` — which fails the `Unit Tests fast-path (1/4)`
shard on every open pull request against `release/v3.8.51`.

2
src/app/api/providers/[id]/test/route.ts
View File

@@ -244,7 +244,7 @@ function isTokenExpired(connection: any) {
// token — but is capped and stripped of control characters defensively before it reaches
// the stored/surfaced error message, per docs/security/ERROR_SANITIZATION.md.
function sanitizeUpstreamBodyText(bodyText: string): string {
const collapsed = bodyText.replace(/[\r\n\t-]+/g, " ").trim();
const collapsed = bodyText.replace(/[\r\n\t\x00-\x1f]+/g, " ").trim();
const MAX_LENGTH = 300;
return collapsed.length > MAX_LENGTH ? `${collapsed.slice(0, MAX_LENGTH)}…` : collapsed;
}