From a961501b6d6af8d6e698691a0125fc9e0279f04f Mon Sep 17 00:00:00 2001 From: IgorRachkov <89467086+igor04091968@users.noreply.github.com> Date: Sun, 14 Jun 2026 14:52:54 +0300 Subject: [PATCH] fix(portal): avoid owned header comparison --- .../detmir-portal/src/production/request_context.rs | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/adk-rust/crates/detmir-portal/src/production/request_context.rs b/adk-rust/crates/detmir-portal/src/production/request_context.rs index 7ffb734..0dea7ab 100644 --- a/adk-rust/crates/detmir-portal/src/production/request_context.rs +++ b/adk-rust/crates/detmir-portal/src/production/request_context.rs @@ -1,8 +1,5 @@ //! Request correlation and route classification for portal observability. //! -//! This module derives a low-cardinality route name, business module and role -//! label for each request. These fields are used by structured logs and metrics. -//! //! CONTRACT: generated route names must not expose volatile identifiers such as //! case IDs, candidate IDs or evidence IDs; use route templates instead. @@ -81,7 +78,7 @@ fn request_header(request: &Request, name: &str) -> Option { request .headers() .iter() - .find(|header| header.field.to_string().eq_ignore_ascii_case(name)) + .find(|header| header.field.equiv(name)) .map(|header| header.value.as_str().to_string()) } @@ -101,9 +98,6 @@ fn resolve_request_ids( } fn sanitize_request_token(value: String) -> String { - // SECURITY: log correlation tokens are accepted from reverse proxies and - // clients, so strip control characters and path separators before they reach - // logs or metric labels. Truncation bounds accidental high-cardinality input. value .chars() .filter(|ch| ch.is_ascii_alphanumeric() || matches!(ch, '-' | '_' | '.' | ':'))