Function sanitizeHeaderValue

src/utils/hooks/execHttpHook.ts:76–79

* Strip CR, LF, and NUL bytes from a header value to prevent HTTP header * injection (CRLF injection) via env var values or hook-configured header * templates. A malicious env var like "token\r\nX-Evil: 1" would otherwise * inject a second header into the request.

(value: string)

 * inject a second header into the request.
 */
function sanitizeHeaderValue(value: string): string {
  // eslint-disable-next-line no-control-regex
  return value.replace(/[\r\n\x00]/g, '')
}

/**
 * Interpolate $VAR_NAME and ${VAR_NAME} patterns in a string using process.env,