From 4e519fa4b72e9cac8cb57c6507497b86124b2f98 Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Mon, 12 Oct 2026 17:55:26 +0200 Subject: [PATCH] Backend: the correlation-id gate anchors with \z .NET's $ also matches before a final newline, so "7c9e6679\n" passed the allow-list that guards the inbound X-Correlation-ID against CRLF and log forgery and was echoed. Such a value does not arrive over HTTP, but the gate now holds what its comment promises; a new test case pins it (red with $). Co-Authored-By: Claude Opus 5.5 --- .../CorrelationIdMiddlewareTests.cs | 1 + .../Middleware/CorrelationIdMiddleware.cs | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/src/Backend/AutopilotMonitor.Functions.Tests/CorrelationIdMiddlewareTests.cs b/src/Backend/AutopilotMonitor.Functions.Tests/CorrelationIdMiddlewareTests.cs index 95313037..71e55808 100644 --- a/src/Backend/AutopilotMonitor.Functions.Tests/CorrelationIdMiddlewareTests.cs +++ b/src/Backend/AutopilotMonitor.Functions.Tests/CorrelationIdMiddlewareTests.cs @@ -116,6 +116,7 @@ public class CorrelationIdMiddlewareTests "", "7c9e6679 a1b2", "7c9e6679\r\nX-Forged: 1", + "7c9e6679\n", // .NET's `$` also matches before a final newline; the gate anchors with `\z` "7c9e6679.a1b2", "7c9e6679-รค", new string('a', 129), diff --git a/src/Backend/AutopilotMonitor.Functions/Middleware/CorrelationIdMiddleware.cs b/src/Backend/AutopilotMonitor.Functions/Middleware/CorrelationIdMiddleware.cs index 59ae5d87..499798cb 100644 --- a/src/Backend/AutopilotMonitor.Functions/Middleware/CorrelationIdMiddleware.cs +++ b/src/Backend/AutopilotMonitor.Functions/Middleware/CorrelationIdMiddleware.cs @@ -26,7 +26,8 @@ public class CorrelationIdMiddleware : IFunctionsWorkerMiddleware internal const string ExposedHeaders = "X-Correlation-ID, Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset"; // Strict allow-list gate against CRLF / log-forgery / App-Insights row-injection via inbound header. - private static readonly Regex CorrelationIdPattern = new("^[A-Za-z0-9_-]{1,128}$", RegexOptions.Compiled); + // Anchored with \z: .NET's $ also matches before a final "\n". + private static readonly Regex CorrelationIdPattern = new(@"^[A-Za-z0-9_-]{1,128}\z", RegexOptions.Compiled); private readonly ILogger _logger;