Repository navigation
fix(sanitizer): strip zero-width chars from Anthropic-native streaming text_delta (#8271) - #8287
Merged
diegosouzapw merged 1 commit intoJul 23, 2026
Conversation
…g text_delta (#8271) sanitizeStreamingChunk() only stripped zero-width characters (U+200B, U+200C, U+200D, U+FEFF) from OpenAI-format choices[].delta.content. Anthropic-native content_block_delta events with text_delta or thinking_delta payloads bypassed that path entirely, leaking U+200D to clients on the Messages API streaming route. Add a content_block_delta branch that strips zero-width characters from delta.text and delta.thinking before returning the event, matching the existing OpenAI path behavior from #5857.
Collaborator
|
Thanks, @Dingding-leo! 🙏 Merged — strips zero-width chars from Anthropic-native sanitizer input. Nice hardening. |
diegosouzapw
merged commit Jul 23, 2026
acd3d46
into
cheaper-inference:release/v3.8.49
5 checks passed
1 of 4 tasks
Merged
HouMinXi
pushed a commit
to HouMinXi/OmniRoute
that referenced
this pull request
Aug 2, 2026
…g text_delta (cheaper-inference#8271) (cheaper-inference#8287) sanitizeStreamingChunk() only stripped zero-width characters (U+200B, U+200C, U+200D, U+FEFF) from OpenAI-format choices[].delta.content. Anthropic-native content_block_delta events with text_delta or thinking_delta payloads bypassed that path entirely, leaking U+200D to clients on the Messages API streaming route. Add a content_block_delta branch that strips zero-width characters from delta.text and delta.thinking before returning the event, matching the existing OpenAI path behavior from cheaper-inference#5857. Co-authored-by: Austin Liu <austinliu@Austins-MacBook-Air-3.local>
5 tasks done
muhamadgalihsaputra
pushed a commit
to niyatna/NiyatnaRoute
that referenced
this pull request
Sep 27, 2026
…g text_delta (cheaper-inference#8271) (cheaper-inference#8287) sanitizeStreamingChunk() only stripped zero-width characters (U+200B, U+200C, U+200D, U+FEFF) from OpenAI-format choices[].delta.content. Anthropic-native content_block_delta events with text_delta or thinking_delta payloads bypassed that path entirely, leaking U+200D to clients on the Messages API streaming route. Add a content_block_delta branch that strips zero-width characters from delta.text and delta.thinking before returning the event, matching the existing OpenAI path behavior from cheaper-inference#5857. Co-authored-by: Austin Liu <austinliu@Austins-MacBook-Air-3.local>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #8271.
sanitizeStreamingChunk()only stripped zero-width characters (U+200B,U+200C,U+200D,U+FEFF) from OpenAI-formatchoices[].delta.content. Anthropic-nativecontent_block_deltaevents withtext_deltaorthinking_deltapayloads bypassed that path entirely, leaking zero-width characters to clients on the Messages API streaming route.Root Cause
The sanitizer had two code paths:
response.*events →sanitizeResponsesStreamingEvent()choices[].delta.content→ zero-width stripAnthropic
content_block_deltaevents fell through as unrecognized and were returned with onlyid/object/created/modelstripped — text payloads (delta.text,delta.thinking) passed through unmodified.Changes
open-sse/handlers/responseSanitizer.ts: Add acontent_block_deltabranch that strips zero-width characters fromdelta.textanddelta.thinkingbefore returning the event. Matches the existing OpenAI path behavior from fix(sse): strip zero-width markers from streamed responses (parity with non-streaming) #5857.Verification
npx tsc --pretty false -p tsconfig.typecheck-core.json— zero errorstests/unit/response-sanitizer.test.ts— 50/50 pass1 file changed, +17