Current behavior:
Body sanitization exists but query parameters and path params are not sanitized for control characters.
Expected behavior:
Add preHandler hook that sanitizes all req.query and req.params string values: remove null bytes (\x00), newlines, other ASCII control characters (0x00–0x1F except \t). Log warning when sanitization applied.
Files to modify:
services/api-gateway/src/index.ts — add sanitization hook
Test requirements:
- Send query param with null byte — sanitized, warning logged.
- Send clean query param — no warning.
Acceptance criteria:
- Control characters removed from query and path params.
- No impact on legitimate requests.
Current behavior:
Body sanitization exists but query parameters and path params are not sanitized for control characters.
Expected behavior:
Add preHandler hook that sanitizes all
req.queryandreq.paramsstring values: remove null bytes (\x00), newlines, other ASCII control characters (0x00–0x1F except\t). Log warning when sanitization applied.Files to modify:
services/api-gateway/src/index.ts— add sanitization hookTest requirements:
Acceptance criteria: