actions/ai-inference
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

chore: relax HTTP header name validation to match RFC 7230

Browse Source 
Updated the regex in `src/helpers.ts` to allow all valid characters in an HTTP token (RFC 7230, section 3.2.6), including symbols like `_`, `.`, `!`, and `*`. Previously, the validation was overly restrictive, only allowing alphanumeric characters and hyphens.

Also updated the corresponding unit test in `__tests__/helpers.test.ts` to reflect the change.
This commit is contained in:
google-labs-jules[bot]
2026-02-24 17:44:57 +00:00
parent a380166897
commit 326b9a12f4
2 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
__tests__/helpers.test.ts
+1 -3
View File
@@ -214,13 +214,11 @@ valid123: value5`
expect(result).toEqual({ expect(result).toEqual({
'valid-header': 'value1', 'valid-header': 'value1',
invalid_underscore: 'value3',
valid123: 'value5', valid123: 'value5',
}) })
expect(core.warning).toHaveBeenCalledWith(expect.stringContaining('Skipping invalid header name: invalid header')) expect(core.warning).toHaveBeenCalledWith(expect.stringContaining('Skipping invalid header name: invalid header'))
expect(core.warning).toHaveBeenCalledWith(
expect.stringContaining('Skipping invalid header name: invalid_underscore'),
)
expect(core.warning).toHaveBeenCalledWith(expect.stringContaining('Skipping invalid header name: invalid@header')) expect(core.warning).toHaveBeenCalledWith(expect.stringContaining('Skipping invalid header name: invalid@header'))
}) })
src/helpers.ts
+4 -3
View File
@@ -121,9 +121,10 @@ function validateAndMaskHeaders(headers: Record<string, unknown>): Record<string
const sensitivePatterns = ['key', 'token', 'secret', 'password', 'authorization'] const sensitivePatterns = ['key', 'token', 'secret', 'password', 'authorization']
for (const [name, value] of Object.entries(headers)) { for (const [name, value] of Object.entries(headers)) {
// Validate header name (basic HTTP header name validation, RFC 7230: letters, digits, and hyphens) // Validate header name (RFC 7230: token = 1*tchar)
if (!/^[A-Za-z0-9-]+$/.test(name)) { // tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." / "^" / "_" / "`" / "|" / "~" / DIGIT / ALPHA
core.warning(`Skipping invalid header name: ${name} (only alphanumeric characters and hyphens allowed)`) if (!/^[A-Za-z0-9!#$%&'*+\-.^_`|~]+$/.test(name)) {
core.warning(`Skipping invalid header name: ${name} (contains invalid characters)`)
continue continue
} }