E-conomic API returns HTTP 400 when text-line descriptions contain certain
characters. The most common case is '/' in the order reference field,
which causes the entire draft-invoice export to fail.
This change adds a single sanitizer class (economic_export_sanitizer) that
handles all user-input fields flowing into e-conomic:
- sanitizeTextLine() — for plain text lines (reference, notes, po, reg_*, etc.)
- sanitizeProductNumber() — for product identifiers
- sanitizeProductDescription() — for product-line descriptions
- sanitizeForEconApi() — catch-all
Sanitization rules:
- '/' is replaced with '-' (the reported 400 trigger)
- Control characters (\x00-\x1F except \t and \n) are stripped
- Tab and newline characters collapse to a single space
- Whitespace is normalized and trimmed
- Lengths capped (text 250, product 50, description 500) with '...' suffix
Applied to all vulnerable fields in economic_invoice_draft.php:
- order.po
- order.reference (PRIMARY FIX for the reported issue)
- order.notes
- order.reg_1/2/3
- order_item.reference
- order_item.notes
- product.description
- product.productNumber
- department_name
Test coverage:
- 31 unit tests with 45 assertions
- All edge cases (null, empty, control chars, multibyte, very long)
- Lint and test suite both pass
Refs: TRU-189, TRU-190, TRU-191, TRU-192, TRU-193, TRU-194, TRU-196
OpenClaw
96ec0c2411