.NET: Validate HTTP header delimiters

[Roger Barreto (rogerbarreto)]

Motivation & Context

Request metadata can reach HTTP transport APIs from more than one package and lifecycle path. These values need consistent delimiter validation before they are stored or written as headers so invalid metadata fails predictably without changing valid requests.

Description & Review Guide

• What are the major changes? Adds one internal shared-source HTTP header validator, injects it only into Foundry and Declarative Workflows, validates delegated user identity during session binding and final transport stamping, and adds coverage for normal, streaming, synchronous, and asynchronous paths.
• What is the impact of these changes? Values containing NUL, carriage return, or line feed are rejected before transport. Existing valid header values and package-specific exception messages remain unchanged.
• What do you want reviewers to focus on? The shared-source injection boundary and the defense-in-depth validation at both identity binding and final header stamping.

Related Issue

N/A. This hardening change is tracked outside GitHub.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and the title prefix in sync automatically.

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): 7d82b2f94daa
Model: gpt-5.6-sol-fast

Overview

The PR centralizes NUL/CR/LF validation in an opt-in shared source and applies it at both metadata binding and final transport boundaries, with synchronous, asynchronous, streaming, and restored-state coverage. Validation-before-mutation ordering and transport assertions provide strong guardrails. One restored-state edge case remains: delimiter-only identities are classified as whitespace before the new transport validator runs, allowing the request to continue without its delegated identity.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
1 verified finding remained after source verification (1 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: dotnet/src/Microsoft.Agents.AI.Foundry/UserIdentityPolicy.cs

[github-code-quality]

Code Coverage Overview

Languages: C#

C# / code-coverage/dotnet

The overall line coverage in commit 32dcc03 in the i285r130-input-trans... branch is 85%. Line coverage data for the main branch is not yet available.

Show a line coverage summary of the most covered files.

File	main	i285r130-input-trans... 32dcc03	+/-
/home/runner/wo...valConverter.cs	—	100%	—
/home/runner/wo...entsProvider.cs	—	99%	—
/home/runner/wo...egatingAgent.cs	—	99%	—
/home/runner/wo...nticAnalyzer.cs	—	94%	—
/home/runner/wo...putConverter.cs	—	90%	—
/home/runner/wo...kflowBuilder.cs	—	90%	—
/home/runner/wo...SkillsSource.cs	—	89%	—
/home/runner/wo...onExtensions.cs	—	81%	—
/home/runner/wo...CopilotAgent.cs	—	76%	—
/home/runner/wo...ctionVisitor.cs	—	75%	—

---

_{Updated September 29, 2026 15:08 UTC}

[github-actions]

MAF Automated Review — Iteration 2

Result: No findings
Scope: 2 net-new commit(s): aadb0233d6e3, 32dcc0373f94
Model: gpt-5.6-sol-fast

Overview

The incremental change fixes the previously reported delimiter-only identity bypass by validating every non-null restored identity before preserving the existing whitespace-as-absent behavior. The strongest guardrails are the shared final-boundary validation, common sync/async stamping path, and direct plus end-to-end coverage asserting that invalid identities never reach transport. No residual Critical, High, or Medium issue is supported by the reviewed diff.

Reviewed the supplied incremental change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.

[Copilot]

Copilot review overview

🟢 Approval recommended

The validation is consistently applied at binding and transport boundaries with comprehensive targeted coverage.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Reject whitespace-only identities containing delimiters