From a231ada539f987212b538bd4968496bb505d5640 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 7 Sep 2026 06:11:07 +0000
Subject: [PATCH] fix(OPENFRAM-003-9):
 ToolApiWebSocketProxyUrlFilter.getRequestToolId hardcodes path segment index
 without bounds checking

---
 .../config/ws/ToolApiWebSocketProxyUrlFilter.java        | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/openframe-gateway-service-core/src/main/java/com/openframe/gateway/config/ws/ToolApiWebSocketProxyUrlFilter.java b/openframe-gateway-service-core/src/main/java/com/openframe/gateway/config/ws/ToolApiWebSocketProxyUrlFilter.java
index 9b9f77c13e..f8150016f6 100644
--- a/openframe-gateway-service-core/src/main/java/com/openframe/gateway/config/ws/ToolApiWebSocketProxyUrlFilter.java
+++ b/openframe-gateway-service-core/src/main/java/com/openframe/gateway/config/ws/ToolApiWebSocketProxyUrlFilter.java
@@ -5,7 +5,9 @@
 import com.openframe.data.document.tool.IntegratedTool;
 import com.openframe.data.reactive.repository.tool.ReactiveIntegratedToolRepository;
 import org.springframework.http.HttpHeaders;
+import org.springframework.http.HttpStatus;
 import org.springframework.stereotype.Component;
+import org.springframework.web.server.ResponseStatusException;
 import org.springframework.web.server.ServerWebExchange;
 
 import java.util.Map;
@@ -28,7 +30,11 @@ public ToolApiWebSocketProxyUrlFilter(
 
     @Override
     protected String getRequestToolId(String path) {
-        return path.split("/")[3];
+        String[] segments = path.split("/");
+        if (segments.length < 4) {
+            throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "Invalid WebSocket proxy path: " + path);
+        }
+        return segments[3];
     }
 
     @Override
@@ -48,3 +54,4 @@ protected ServerWebExchange mutateExchange(ServerWebExchange exchange, Integrate
                 .build();
     }
 }
+