From 4697a0873d3b330d3cac9946e6b07e67d17b6068 Mon Sep 17 00:00:00 2001 From: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Date: Wed, 16 Sep 2026 12:52:26 -0300 Subject: [PATCH] fix(api): escape the raw control bytes #13758 left in the provider-test sanitizer The `sanitizeUpstreamBodyText` character class carried a literal NUL (0x00) and a literal 0x1f instead of the `\x00-\x1f` escapes. The regex behaved identically at runtime, but a raw NUL in tracked source trips tests/unit/source-no-raw-nul-bytes.test.ts, which reddens the Unit Tests fast-path (1/4) shard for every PR opened against release/v3.8.51. Refs #12958 --- changelog.d/fixes/13758-raw-nul-byte-provider-test-route.md | 5 +++++ src/app/api/providers/[id]/test/route.ts | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 changelog.d/fixes/13758-raw-nul-byte-provider-test-route.md diff --git a/changelog.d/fixes/13758-raw-nul-byte-provider-test-route.md b/changelog.d/fixes/13758-raw-nul-byte-provider-test-route.md new file mode 100644 index 0000000000..6f04bef004 --- /dev/null +++ b/changelog.d/fixes/13758-raw-nul-byte-provider-test-route.md @@ -0,0 +1,5 @@ +Replaced the raw control bytes that #13758 left inside the `sanitizeUpstreamBodyText` +character class in `src/app/api/providers/[id]/test/route.ts` with their `\x00-\x1f` +escapes. The range was byte-identical at runtime, but the literal NUL in the source broke +`tests/unit/source-no-raw-nul-bytes.test.ts` — which fails the `Unit Tests fast-path (1/4)` +shard on every open pull request against `release/v3.8.51`. diff --git a/src/app/api/providers/[id]/test/route.ts b/src/app/api/providers/[id]/test/route.ts index 7d72f28098..05b126b6d2 100644 --- a/src/app/api/providers/[id]/test/route.ts +++ b/src/app/api/providers/[id]/test/route.ts @@ -244,7 +244,7 @@ function isTokenExpired(connection: any) { // token — but is capped and stripped of control characters defensively before it reaches // the stored/surfaced error message, per docs/security/ERROR_SANITIZATION.md. function sanitizeUpstreamBodyText(bodyText: string): string { - const collapsed = bodyText.replace(/[\r\n\t-]+/g, " ").trim(); + const collapsed = bodyText.replace(/[\r\n\t\x00-\x1f]+/g, " ").trim(); const MAX_LENGTH = 300; return collapsed.length > MAX_LENGTH ? `${collapsed.slice(0, MAX_LENGTH)}…` : collapsed; }