pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-19 21:52:21 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): return 400 (not 500) for malformed JSON on /api/auth/login (#4031)

Browse Source 
Wrap request.json() so a malformed/non-JSON login body returns a structured 400 instead of falling through to the 500 catch. Fixes the schemathesis high-risk-endpoint DAST finding (verified: schemathesis step now passes). +TDD test. Integrated into release/v3.8.27.
This commit is contained in:
Randi
2026-06-16 18:21:27 -04:00
committed by GitHub
parent dd374df312
commit b2479d8d2a
4 changed files with 50 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/shared/utils/inputSanitizer.ts
View File

@@ -26,7 +26,7 @@ const INJECTION_PATTERNS = [
{
name: "system_prompt_leak",
pattern:
/\b(reveal|show|display|print|output|repeat)\s+(your\s+)?(system\s+prompt|instructions?|initial\s+prompt|hidden\s+prompt)/i,
/\b(reveals?|shows?|displays?|prints?|outputs?|repeats?)\s+((your|the)\s+)?(system\s+prompt|instructions?|initial\s+prompt|hidden\s+prompt)/i,
severity: "high",
},
{