mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-14 19:02:17 +03:00
a1d6ff5fbf
Boarded with #11741 (a duplicate fix for the same underlying issue #11739). Compared both implementations directly: this one is technically superior — a dedicated resolveIncomingCorrelationId() helper that strips CRLF (header-injection prevention) and bounds length to 1-256 chars, with 4 unit tests covering those edge cases. #11741's simpler `header || generateRequestId()` has no sanitization. Closing #11741 with credit. Validated in a combined worktree: typecheck:core, check:dashboard-typecheck, check:file-size, check:changelog-integrity, check:complexity, check:cognitive-complexity, check:cycles, check-deps all green; 84/84 + 43/43 focused tests pass across this batch. Thanks for the careful sanitization work.
38 lines
1.7 KiB
TypeScript
38 lines
1.7 KiB
TypeScript
import test from "node:test";
|
|
import assert from "node:assert/strict";
|
|
|
|
const { resolveIncomingCorrelationId } = await import(
|
|
"../../src/shared/utils/correlationPreserve.ts"
|
|
);
|
|
|
|
test("resolveIncomingCorrelationId preserves valid caller ID", () => {
|
|
assert.equal(resolveIncomingCorrelationId("caller-correlation"), "caller-correlation");
|
|
assert.equal(resolveIncomingCorrelationId(" spaced-id "), "spaced-id");
|
|
assert.equal(resolveIncomingCorrelationId("abc-123_XYZ"), "abc-123_XYZ");
|
|
});
|
|
|
|
test("resolveIncomingCorrelationId sanitizes header injection", () => {
|
|
assert.equal(resolveIncomingCorrelationId("evil\r\nInjected: true"), "evilInjected: true");
|
|
assert.equal(resolveIncomingCorrelationId("with\nnewline"), "withnewline");
|
|
assert.equal(resolveIncomingCorrelationId("with\rcarriage"), "withcarriage");
|
|
});
|
|
|
|
test("resolveIncomingCorrelationId rejects empty and overlong", () => {
|
|
assert.equal(resolveIncomingCorrelationId(null), null);
|
|
assert.equal(resolveIncomingCorrelationId(undefined), null);
|
|
assert.equal(resolveIncomingCorrelationId(""), null);
|
|
assert.equal(resolveIncomingCorrelationId(" "), null);
|
|
const long = "a".repeat(257);
|
|
assert.equal(resolveIncomingCorrelationId(long), null);
|
|
assert.equal(resolveIncomingCorrelationId("a".repeat(256)), "a".repeat(256));
|
|
});
|
|
|
|
test("resolveIncomingCorrelationId trims before length check", () => {
|
|
// 256 chars plus surrounding spaces should still be valid after trim
|
|
const spacedLong = " " + "a".repeat(256) + " ";
|
|
assert.equal(resolveIncomingCorrelationId(spacedLong), "a".repeat(256));
|
|
// 257 after trim should be rejected
|
|
const spacedTooLong = " " + "a".repeat(257) + " ";
|
|
assert.equal(resolveIncomingCorrelationId(spacedTooLong), null);
|
|
});
|