fix(timing): escape double quotes and backslashes in Server-Timing descriptions

[MustafaKemal0146]

The author should do the following, if applicable

• Add tests
• Run tests
• pnpm run check:fix to format and lint the code
• Add TSDoc/JSDoc to document the code

Description

In src/middleware/timing/timing.ts, metric descriptions (description and valueDescription) were interpolated into desc="..." without escaping quotes or backslashes.

When descriptions contain double quotes (e.g. setMetric(c, 'db', 12.3, 'Query "users"')), the resulting header has invalid syntax:

Server-Timing: db;dur=12.3;desc="Query "users""

According to RFC 9110 Section 5.6.4 and W3C Server Timing Section 2.1, desc is serialized as a quoted-string; inner " and \ characters must be backslash-escaped.

This change escapes backslashes and double quotes in description and valueDescription:

const metric = description
  ? `${name};dur=${dur};desc="${description.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`
  : `${name};dur=${dur}`

This fixes quoted-string escaping per RFC 9110 and matches the quote-escaping approach in Hono's bearer-auth middleware.

Test Plan

Added unit tests in src/middleware/timing/index.test.ts verifying expected header outputs:

• Numeric metric description: 'db;dur=12.3;desc="Query \\"users\\""'
• Value-less metric description: 'cache;desc="hit \\"fast\\""'
• Description with backslashes: 'fs;dur=5.0;desc="path\\\\to\\\\\\"file\\""'
• Custom totalDescription: 'desc="Total \\"App\\" Time"'

Verification:

• pnpm exec vitest run src/middleware/timing (20/20 passed)
• pnpm run check:fix (clean)

Disclosure: Implemented with AI assistance under human review.

[Copilot]

Copilot review overview

🟢 Approval recommended

No unresolved review comments remain, and regression coverage is included.

Review effort: Lite
Findings: None

What changed in this PR

Fixes Server-Timing description serialization by escaping backslashes and double quotes.

Changes:

• Escapes metric descriptions before header serialization.
• Adds regression tests for quotes, backslashes, and total descriptions.

File	Summary
src/​middleware/​timing/​timing.ts	Escapes quoted-string characters in metric descriptions.
src/​middleware/​timing/​index.test.ts	Adds serialization tests for escaped descriptions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.