[Duplicate Code] BYOK header and body-field sanitization repeat the same validation scaffold

[github-actions]

Duplicate Code Opportunity

Summary

• Pattern: parseByokExtraHeaders() and parseByokExtraBodyFields() repeat the same JSON parsing, shape validation, prototype-pollution guard, per-entry iteration, string-type checking, and skip-on-warning flow.
• Locations: containers/api-proxy/providers/copilot-byok.js lines 30-71 and 80-109.
• Impact: ~40 lines of near-identical security-sensitive validation logic that can drift independently for header vs body parsing.

Evidence

// headers
function parseByokExtraHeaders(raw) {
  if (!raw || !raw.trim()) return {};

  let parsed;
  try {
    parsed = JSON.parse(raw.trim());
  } catch {
    console.warn('AWF_BYOK_EXTRA_HEADERS: invalid JSON; ignoring extra headers');
    return {};
  }

  if (typeof parsed !== 'object' || Array.isArray(parsed) || parsed === null) {
    console.warn('AWF_BYOK_EXTRA_HEADERS: expected a JSON object; ignoring extra headers');
    return {};
  }

  const result = {};
  for (const [name, value] of Object.entries(parsed)) {
    const lowerName = name.toLowerCase();
    if (lowerName === '__proto__' || lowerName === 'constructor' || lowerName === 'prototype') {
      ...
    }
    if (PROTECTED_HEADER_NAMES.has(lowerName)) {
      ...
    }
    if (!isValidHeaderName(name)) {
      ...
    }
    if (typeof value !== 'string') {
      ...
    }
    result[name] = value;
  }
}

// body fields
function parseByokExtraBodyFields(raw) {
  if (!raw || !raw.trim()) return {};

  let parsed;
  try {
    parsed = JSON.parse(raw.trim());
  } catch {
    console.warn('AWF_BYOK_EXTRA_BODY_FIELDS: invalid JSON; ignoring extra body fields');
    return {};
  }

  if (typeof parsed !== 'object' || Array.isArray(parsed) || parsed === null) {
    console.warn('AWF_BYOK_EXTRA_BODY_FIELDS: expected a JSON object; ignoring extra body fields');
    return {};
  }

  const result = {};
  for (const [name, value] of Object.entries(parsed)) {
    if (name === '__proto__' || name === 'constructor' || name === 'prototype') {
      ...
    }
    if (typeof value !== 'string') {
      ...
    }
    result[name] = value;
  }
}

Suggested Refactoring

Extract a shared parseJsonStringMap(raw, options) helper that handles the JSON/object/prototype-pollution/string-value checks, then layer header-specific validation (isValidHeaderName, protected header names) on top. That keeps the credential-injection path consistent and reduces future drift.

Affected Files

• containers/api-proxy/providers/copilot-byok.js — lines 30-71
• containers/api-proxy/providers/copilot-byok.js — lines 80-109

Effort Estimate

Medium

---

Detected by Duplicate Code Detector workflow. Run date: 2026-07-23

Generated by Duplicate Code Detector · 6.71 AIC · ⊞ 23.7K · ◷

• expires on Aug 22, 2026, 6:36 AM UTC