fix(OPENFRAM-003-9): CU-86akeeczr ToolApiWebSocketProxyUrlFilter.getRequestToolId hardcodes path segment index without bounds checking

[flamingo]

Closes findings from rule OPENFRAM-003-9 — ToolApiWebSocketProxyUrlFilter.getRequestToolId hardcodes path segment index without bounds checking.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟡 85 medium	ToolApiWebSocketProxyUrlFilter.getRequestToolId hardcodes path segment index without bounds checking	openframe-gateway-service-core/src/main/java/com/openframe/gateway/config/ws/ToolApiWebSocketProxyUrlFilter.java:29

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 4f0d6344-55d4-49de-bc86-cac2510f432f

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akeeczr OpenFrame lib batch review findings sweep 2 (13 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

1 finding(s) fixed in this draft — 1 explained inline on the diff.

[flamingo]

🦩 🟠 ToolApiWebSocketProxyUrlFilter.getRequestToolId hardcodes path segment index without bounds checking

In getRequestToolId(String path), replaced the unchecked path.split("/")[3] array access with a bounds check on segments.length < 4 that throws a ResponseStatusException with HttpStatus.BAD_REQUEST instead of allowing an unhandled ArrayIndexOutOfBoundsException to propagate, giving callers a controlled 400 response for malformed/short WebSocket upgrade paths.

🤖 Prompt for AI agents

In openframe-gateway-service-core/src/main/java/com/openframe/gateway/config/ws/ToolApiWebSocketProxyUrlFilter.java around line 29, review and complete this code-review fix: ToolApiWebSocketProxyUrlFilter.getRequestToolId hardcodes path segment index without bounds checking.
What the draft fix changed: In `getRequestToolId(String path)`, replaced the unchecked `path.split("/")[3]` array access with a bounds check on `segments.length < 4` that throws a `ResponseStatusException` with `HttpStatus.BAD_REQUEST` instead of allowing an unhandled `ArrayIndexOutOfBoundsException` to propagate, giving callers a controlled 400 response for malformed/short WebSocket upgrade paths.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 85 medium — react 👍/👎 to teach the reviewer

[michaelassraf]

Task linked: CU-86akeeczr OpenFrame lib batch review findings sweep 2 (12 PRs)