From 326b9a12f48dd7bd841a3feecb1626c1909fedd5 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Tue, 24 Feb 2026 17:44:57 +0000
Subject: [PATCH] chore: relax HTTP header name validation to match RFC 7230

Updated the regex in `src/helpers.ts` to allow all valid characters in an HTTP token (RFC 7230, section 3.2.6), including symbols like `_`, `.`, `!`, and `*`. Previously, the validation was overly restrictive, only allowing alphanumeric characters and hyphens.

Also updated the corresponding unit test in `__tests__/helpers.test.ts` to reflect the change.
---
 __tests__/helpers.test.ts | 4 +---
 src/helpers.ts            | 7 ++++---
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/__tests__/helpers.test.ts b/__tests__/helpers.test.ts
index fe22b76..e8f4629 100644
--- a/__tests__/helpers.test.ts
+++ b/__tests__/helpers.test.ts
@@ -214,13 +214,11 @@ valid123: value5`
 
       expect(result).toEqual({
         'valid-header': 'value1',
+        invalid_underscore: 'value3',
         valid123: 'value5',
       })
 
       expect(core.warning).toHaveBeenCalledWith(expect.stringContaining('Skipping invalid header name: invalid header'))
-      expect(core.warning).toHaveBeenCalledWith(
-        expect.stringContaining('Skipping invalid header name: invalid_underscore'),
-      )
       expect(core.warning).toHaveBeenCalledWith(expect.stringContaining('Skipping invalid header name: invalid@header'))
     })
 
diff --git a/src/helpers.ts b/src/helpers.ts
index ff79c0e..7ff3ce8 100644
--- a/src/helpers.ts
+++ b/src/helpers.ts
@@ -121,9 +121,10 @@ function validateAndMaskHeaders(headers: Record<string, unknown>): Record<string
   const sensitivePatterns = ['key', 'token', 'secret', 'password', 'authorization']
 
   for (const [name, value] of Object.entries(headers)) {
-    // Validate header name (basic HTTP header name validation, RFC 7230: letters, digits, and hyphens)
-    if (!/^[A-Za-z0-9-]+$/.test(name)) {
-      core.warning(`Skipping invalid header name: ${name} (only alphanumeric characters and hyphens allowed)`)
+    // Validate header name (RFC 7230: token = 1*tchar)
+    // tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." / "^" / "_" / "`" / "|" / "~" / DIGIT / ALPHA
+    if (!/^[A-Za-z0-9!#$%&'*+\-.^_`|~]+$/.test(name)) {
+      core.warning(`Skipping invalid header name: ${name} (contains invalid characters)`)
       continue
     }