Skip to content

fix(OPENFRAM-003-9): CU-86akeeczr ToolApiWebSocketProxyUrlFilter.getRequestToolId hardcodes path segment index without bounds checking #2084

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
flamingo wants to merge 1 commit into
base: main
Choose a base branch
from
+8 −1
Draft

fix(OPENFRAM-003-9): CU-86akeeczr ToolApiWebSocketProxyUrlFilter.getRequestToolId hardcodes path segment index without bounds checking #2084

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion ...ce-core/src/main/java/com/openframe/gateway/config/ws/ToolApiWebSocketProxyUrlFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@
import com.openframe.data.document.tool.IntegratedTool;
import com.openframe.data.reactive.repository.tool.ReactiveIntegratedToolRepository;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpStatus;
import org.springframework.stereotype.Component;
import org.springframework.web.server.ResponseStatusException;
import org.springframework.web.server.ServerWebExchange;

import java.util.Map;
Expand All @@ -28,7 +30,11 @@ public ToolApiWebSocketProxyUrlFilter(

@Override

@flamingo flamingo Bot Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🦩 🟠 ToolApiWebSocketProxyUrlFilter.getRequestToolId hardcodes path segment index without bounds checking

In getRequestToolId(String path), replaced the unchecked path.split("/")[3] array access with a bounds check on segments.length < 4 that throws a ResponseStatusException with HttpStatus.BAD_REQUEST instead of allowing an unhandled ArrayIndexOutOfBoundsException to propagate, giving callers a controlled 400 response for malformed/short WebSocket upgrade paths.

🤖 Prompt for AI agents 
In openframe-gateway-service-core/src/main/java/com/openframe/gateway/config/ws/ToolApiWebSocketProxyUrlFilter.java around line 29, review and complete this code-review fix: ToolApiWebSocketProxyUrlFilter.getRequestToolId hardcodes path segment index without bounds checking.
What the draft fix changed: In `getRequestToolId(String path)`, replaced the unchecked `path.split("/")[3]` array access with a bounds check on `segments.length < 4` that throws a `ResponseStatusException` with `HttpStatus.BAD_REQUEST` instead of allowing an unhandled `ArrayIndexOutOfBoundsException` to propagate, giving callers a controlled 400 response for malformed/short WebSocket upgrade paths.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 85 medium — react 👍/👎 to teach the reviewer

protected String getRequestToolId(String path) {
return path.split("/")[3];
String[] segments = path.split("/");
if (segments.length < 4) {
throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "Invalid WebSocket proxy path: " + path);
}
return segments[3];
}

@Override
Expand All @@ -48,3 +54,4 @@ protected ServerWebExchange mutateExchange(ServerWebExchange exchange, Integrate
.build();
}
}