fix(backend): handle malformed host headers gracefully to prevent crashes

packages/backend/src/tokens/__tests__/clerkRequest.test.ts

@@ -158,6 +158,27 @@ describe('createClerkRequest', () => {
       const req2 = new Request('http://localhost:3000////path');
       expect(createClerkRequest(req2).clerkUrl.toString()).toBe('http://localhost:3000////path');
     });
+
+    it('should handle malformed x-forwarded-host header gracefully', () => {
+      const req = new Request('http://localhost:3000/path', {
+        headers: {
+          'x-forwarded-host': 'z2cgvm.xfh"></script><script>alert(document.domain);</script>',
+          'x-forwarded-proto': 'https',
+        },
+      });
+      // Should fall back to original URL instead of throwing
+      expect(createClerkRequest(req).clerkUrl.toString()).toBe('http://localhost:3000/path');
+    });
+
+    it('should handle malformed host header gracefully', () => {
+      const req = new Request('http://localhost:3000/path', {
+        headers: {
+          host: 'z2cgvm.xfh"></script><script>alert(document.domain);</script>',
+        },
+      });
+      // Should fall back to original URL instead of throwing
+      expect(createClerkRequest(req).clerkUrl.toString()).toBe('http://localhost:3000/path');
+    });
   });
 
   describe('toJSON', () => {

packages/backend/src/tokens/clerkRequest.ts

@@ -59,7 +59,13 @@ class ClerkRequest extends Request {
     if (origin === initialUrl.origin) {
       return createClerkUrl(initialUrl);
     }
-    return createClerkUrl(initialUrl.pathname + initialUrl.search, origin);
+    try {
+      return createClerkUrl(initialUrl.pathname + initialUrl.search, origin);
+    } catch {
+      // If the origin contains invalid characters (e.g., from malicious headers),
+      // fall back to using the original request URL to prevent the application from crashing
+      return createClerkUrl(initialUrl);
+    }
   }
 
   private getFirstValueFromHeader(value?: string | null) {