@trayio/express 4.93.0 → 4.95.0

package/dist/http/ExpressHttpController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ExpressHttpController.d.ts","sourceRoot":"","sources":["../../src/http/ExpressHttpController.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,CAAC,MAAM,cAAc,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AASnD,OAAO,EACN,cAAc,EAEd,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAW1D,qBAAa,qBAAqB;IAEhC,SAAS,CAAC,UAAU,EAAE,cAAc;IACpC,SAAS,CAAC,2BAA2B,EAAE,MAAM;IAC7C,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAFzB,UAAU,EAAE,cAAc,EAC1B,2BAA2B,EAAE,MAAe,EAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAGpC,OAAO,CAAC,QAAQ,CAiGd;IAEF,SAAS,WAAY,MAAM,YAKzB;IAEF,OAAO,CAAC,gBAAgB,CAoBtB;IAGF,OAAO,CAAC,uBAAuB,CAI7B;IAEF,OAAO,CAAC,sBAAsB,CAmC3B;IAEH,OAAO,CAAC,aAAa,CAenB;IAEF,OAAO,CAAC,YAAY,CAkBlB;IAEF,OAAO,CAAC,+BAA+B,CAWpC;CACH"}
+{"version":3,"file":"ExpressHttpController.d.ts","sourceRoot":"","sources":["../../src/http/ExpressHttpController.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,CAAC,MAAM,cAAc,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AASnD,OAAO,EACN,cAAc,EAEd,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAW1D,qBAAa,qBAAqB;IAEhC,SAAS,CAAC,UAAU,EAAE,cAAc;IACpC,SAAS,CAAC,2BAA2B,EAAE,MAAM;IAC7C,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAFzB,UAAU,EAAE,cAAc,EAC1B,2BAA2B,EAAE,MAAe,EAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAGpC,OAAO,CAAC,QAAQ,CA2Fd;IAEF,SAAS,WAAY,MAAM,YAKzB;IAEF,OAAO,CAAC,gBAAgB,CAoBtB;IAGF,OAAO,CAAC,uBAAuB,CAI7B;IAEF,OAAO,CAAC,sBAAsB,CAmC3B;IAEH,OAAO,CAAC,aAAa,CAenB;IAEF,OAAO,CAAC,YAAY,CAkBlB;IAEF,OAAO,CAAC,+BAA+B,CAWpC;CACH"}

package/dist/http/ExpressHttpController.js

@@ -84,14 +84,10 @@ class ExpressHttpController {
                     processedValue = value.join(','); // flatten arrays
                 }
                 // Convert to string and sanitize for HTTP header compliance
-                // Remove control characters (0x00-0x1F, 0x7F), line breaks, and other invalid chars
-                return (String(processedValue)
-                    .replace(/\r\n/g, '_') // CRLF line breaks first
-                    .replace(/[\r\n]/g, '_') // remaining CR or LF
-                    // eslint-disable-next-line no-control-regex
-                    .replace(/[\u0000-\u0009\u000B\u000C\u000E-\u001F\u007F]/g, '_') // other control characters (excluding \n and \r)
-                    .replace(/["\\]/g, '_') // quotes and backslashes
-                    .trim()); // remove leading/trailing whitespace
+                // Keep only valid HTTP header characters: tab, printable ASCII (0x20-0x7E), and extended ASCII (0x80-0xFF)
+                return String(processedValue)
+                    .replace(/[^\t\x20-\x7e\x80-\xff]/g, '_')
+                    .trim();
             };
             const response = Object.entries(httpResponse.headers)
                 .reduce((acc, [key, value]) => acc.setHeader(key, sanitizeHeaderValue(value)), res)

package/dist/http/ExpressHttpController.unit.test.js

@@ -141,9 +141,9 @@ describe('ExpressHttpController', () => {
             };
             mockEndpoint.execute.mockReturnValue(() => T.of(httpResponse));
             await routeHandler(mockReq, mockRes);
-            expect(mockRes.setHeader).toHaveBeenCalledWith('test-header', 'value_with_line_breaks');
+            expect(mockRes.setHeader).toHaveBeenCalledWith('test-header', 'value_with_line__breaks');
         });
-        it('should sanitize header values with quotes and backslashes', async () => {
+        it('should preserve quotes and backslashes as valid characters', async () => {
             const httpResponse = {
                 statusCode: 200,
                 headers: {
@@ -157,7 +157,7 @@ describe('ExpressHttpController', () => {
             };
             mockEndpoint.execute.mockReturnValue(() => T.of(httpResponse));
             await routeHandler(mockReq, mockRes);
-            expect(mockRes.setHeader).toHaveBeenCalledWith('test-header', 'value_with_quotes');
+            expect(mockRes.setHeader).toHaveBeenCalledWith('test-header', 'value"with\\quotes');
         });
         it('should trim whitespace from header values', async () => {
             const httpResponse = {
@@ -221,7 +221,23 @@ describe('ExpressHttpController', () => {
             };
             mockEndpoint.execute.mockReturnValue(() => T.of(httpResponse));
             await routeHandler(mockReq, mockRes);
-            expect(mockRes.setHeader).toHaveBeenCalledWith('test-header', 'value_with__multiple_issues_');
+            expect(mockRes.setHeader).toHaveBeenCalledWith('test-header', 'value_with__"multiple\\issues"');
+        });
+        it('should sanitize header values with em dash character', async () => {
+            const httpResponse = {
+                statusCode: 200,
+                headers: {
+                    'test-header': 'value–with–em–dash',
+                },
+                body: new stream_1.Readable({
+                    read() {
+                        this.push(null);
+                    },
+                }),
+            };
+            mockEndpoint.execute.mockReturnValue(() => T.of(httpResponse));
+            await routeHandler(mockReq, mockRes);
+            expect(mockRes.setHeader).toHaveBeenCalledWith('test-header', 'value_with_em_dash');
         });
     });
     describe('error handling', () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trayio/express",
-  "version": "4.93.0",
+  "version": "4.95.0",
   "description": "Express extensions and implementations",
   "exports": {
     "./*": "./dist/*.js"
@@ -14,7 +14,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@trayio/commons": "4.93.0",
+    "@trayio/commons": "4.95.0",
     "cors": "2.8.5",
     "express": "4.20.0",
     "formidable": "3.5.1"