{"record":{"id":"515022d2b50fdce3","repo":"diegosouzapw/OmniRoute","slug":"security-001-515022","errorCode":"SECURITY_001","errorMessage":"Request blocked: potential prompt injection detected","messagePattern":"Request blocked: potential prompt injection detected","errorType":"http","errorClass":null,"httpStatus":400,"severity":"error","filePath":"src/app/api/v1/completions/route.ts","lineNumber":64,"sourceCode":"  await ensureInitialized();\n\n  // #6422 — capture the compression request header once so we can echo it back\n  // on the response when internal early-returns drop the meta the docs promise.\n  const compressionRequestHeader = readCompressionRequestHeader(request);\n\n  // Prompt injection guard\n  try {\n    const cloned = request.clone();\n    const body = await cloned.json().catch(() => null);\n    if (body) {\n      const { blocked, result } = injectionGuard(body);\n      if (blocked) {\n        return new Response(\n          JSON.stringify({\n            error: {\n              message: \"Request blocked: potential prompt injection detected\",\n              type: \"injection_detected\",\n              code: \"SECURITY_001\",\n              detections: result.detections.length,\n            },\n          }),\n          { status: 400, headers: { ...CORS_HEADERS, \"Content-Type\": \"application/json\" } }\n        );\n      }\n\n      // Normalize legacy completions format: { prompt, model } → { messages, model }\n      // If the body has `prompt` but no `messages`, convert to chat format.\n      if (body.prompt !== undefined && !body.messages) {\n        const prompt = Array.isArray(body.prompt) ? body.prompt.join(\"\\n\") : String(body.prompt);\n        const normalized = {\n          ...body,\n          messages: [{ role: \"user\", content: prompt }],\n        };\n        delete normalized.prompt;\n\n        const newRequest = new Request(request.url, {","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/diegosouzapw/OmniRoute/blob/a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d/src/app/api/v1/completions/route.ts#L46-L82","documentation":"Error \"Request blocked: potential prompt injection detected\" thrown in diegosouzapw/OmniRoute.","triggerScenarios":"Thrown at src/app/api/v1/completions/route.ts:64 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d","analyzedAt":"2026-08-25T18:35:09.898Z","schemaVersion":2},"datasetVersion":"2026-08-25T21:54:21.419Z"}