mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-14 10:52:17 +03:00
a1d6ff5fbf
Boarded with #11741 (a duplicate fix for the same underlying issue #11739). Compared both implementations directly: this one is technically superior — a dedicated resolveIncomingCorrelationId() helper that strips CRLF (header-injection prevention) and bounds length to 1-256 chars, with 4 unit tests covering those edge cases. #11741's simpler `header || generateRequestId()` has no sanitization. Closing #11741 with credit. Validated in a combined worktree: typecheck:core, check:dashboard-typecheck, check:file-size, check:changelog-integrity, check:complexity, check:cognitive-complexity, check:cycles, check-deps all green; 84/84 + 43/43 focused tests pass across this batch. Thanks for the careful sanitization work.
13 lines
474 B
TypeScript
13 lines
474 B
TypeScript
/**
|
|
* Resolve caller-provided X-Correlation-Id for preservation (#11739).
|
|
* Returns sanitized value when present and within bounds (1-256 chars), otherwise null.
|
|
* Strips CRLF to prevent header injection, trims whitespace.
|
|
*/
|
|
export function resolveIncomingCorrelationId(
|
|
headerValue: string | null | undefined
|
|
): string | null {
|
|
const raw = (headerValue ?? "").trim().replace(/[\r\n]/g, "");
|
|
if (raw.length === 0 || raw.length > 256) return null;
|
|
return raw;
|
|
}
|