fix: fix error code usage.

Author: JoshuaSBrown

common/include/common/TraceException.hpp

@@ -48,7 +48,7 @@ class TraceException : public std::exception {
       return m_context;
   }
 
-  unsigned long getErrorCode() { return m_error_code; }
+  unsigned long getErrorCode() const { return m_error_code; }
 
   const char *what() const throw() { return m_context.c_str(); }
 

core/server/SchemaAPIClient.cpp

@@ -1,6 +1,7 @@
 #include "SchemaAPIClient.hpp"
 #include "common/TraceException.hpp"
 #include "common/envelope.pb.h"
+#include "common/enums/error_code.pb.h"
 
 #include <sstream>
 
@@ -55,6 +56,19 @@ SchemaAPIClient::~SchemaAPIClient() {
 
 void SchemaAPIClient::setCustomHeaders(
     const std::map<std::string, std::string> &a_headers) {
+
+  LogContext log_context;
+  for (const auto &[name, value] : a_headers) {
+    // Guard against header injection via CR/LF in header names or values.
+    if (name.find_first_of("\r\n") != std::string::npos ||
+        value.find_first_of("\r\n") != std::string::npos) {
+      throw std::invalid_argument(
+          "Custom header name/value must not contain CR or LF characters");
+
+      DL_ERROR(log_context, "Custom header name/value must not contain CR or LF characters. " << name << " " << value);
+      EXCEPT_PARAM(SERVICE_ERROR, "Custom header name/value must not contain CR or LF characters.");
+    }
+  }
   m_custom_headers = a_headers;
 }
 

core/server/tests/integration/test_SchemaAPIClient.cpp

@@ -8,6 +8,7 @@
 
 // DataFed Common includes
 #include "common/TraceException.hpp"
+#include "common/enums/error_code.pb.h"
 
 #include <nlohmann/json.hpp>
 
@@ -759,7 +760,7 @@ BOOST_AUTO_TEST_CASE(custom_headers_replaced_not_accumulated) {
       TraceException,
       [](const TraceException &ex) {
         // 500 path in httpGet should map to SERVICE_ERROR
-        return ex.getErrorCode() == TraceErrorCode::SERVICE_ERROR;
+        return ex.getErrorCode() == SDMS::SERVICE_ERROR;
       });
 
   // Replace with 404 — should NOT still have 500
@@ -769,7 +770,7 @@ BOOST_AUTO_TEST_CASE(custom_headers_replaced_not_accumulated) {
       TraceException,
       [](const TraceException &ex) {
         // 404 path in httpGet should map to BAD_REQUEST
-        return ex.getErrorCode() == TraceErrorCode::BAD_REQUEST;
+        return ex.getErrorCode() == SDMS::BAD_REQUEST;
       });
 
   // The 404 path in httpGet throws BAD_REQUEST, while 500 throws