pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-07-26 09:52:11 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(quality): clear SonarCloud quality-gate findings on PR #2930

Browse Source 
Quality Gate was failing on New Code with 1 hotspot, 1 vulnerability and
4 reliability bugs. Resolved each at the source (no SonarCloud mark-as-safe):

Reliability (4 bugs → rating back to A):
- usage.ts: drop duplicate `case "opencode-go"` (S1862) — the 2nd case was
  dead (first match wins) and would have called the wrong usage fetcher.
  Also de-duplicate the same id in USAGE_FETCHER_PROVIDERS (mirrors the switch;
  prevented a double quota-fetcher registration).
- ApiManagerPageClient.tsx: a dangling `.find(...)?.timestamp || null` expression
  (S905) discarded the better matcher — `lastUsed` silently lost the
  name-fallback for legacy logs without apiKeyId. Assign the complete matcher.
- chat.ts / auth.ts: `Promise` used in a boolean conditional (S6544). Both are
  intentional (memoized promise / mutex default), not a forgotten await —
  made the intent explicit via `!== null` and `??` (behaviour identical).

Security (vulnerability → rating back to A):
- nvidia-startswith-diag.ts: neutralize CR/LF before logging env-derived
  values (S5145 log injection) in the ad-hoc diagnostic script.

Security Hotspot (reviewed → 0 open):
- pluginWorker.ts uses `vm.runInContext` to run plugin code — that IS the
  worker's purpose, inside a hardened vm sandbox (createContext, require
  allow-list of just `crypto`, 10s timeout); not eval/new Function. Suppress
  S1523 scoped only to pluginWorker.ts in sonar-project.properties, with the
  same documented-justification pattern as the existing hotspot suppressions.
This commit is contained in:
diegosouzapw
2026-06-03 00:17:56 -03:00
parent a907ae714c
commit 705ab8e690
6 changed files with 21 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
sonar-project.properties
View File

@@ -22,7 +22,13 @@ sonar.cpd.exclusions=**/*
# tooling on the user's own machine; running with their PATH is
# intentional and matches the behaviour of every other CLI on the
# system.
sonar.issue.ignore.multicriteria=h1,h2,h3,h4,h5
# S1523 – Dynamic code execution. SCOPED to src/lib/plugins/pluginWorker.ts
# only: running plugin source IS the worker's purpose, and it does so
# inside a hardened Node `vm` sandbox (vm.createContext, a require
# allow-list of just `crypto`, and a 10s execution timeout). Not
# `eval`/`new Function` (Hard Rule #3). S1523 stays active everywhere
# else so a genuine dynamic-exec elsewhere is still flagged.
sonar.issue.ignore.multicriteria=h1,h2,h3,h4,h5,h6
sonar.issue.ignore.multicriteria.h1.ruleKey=javascript:S5852
sonar.issue.ignore.multicriteria.h1.resourceKey=**/*
sonar.issue.ignore.multicriteria.h2.ruleKey=typescript:S5852
@@ -33,3 +39,5 @@ sonar.issue.ignore.multicriteria.h4.ruleKey=javascript:S4036
sonar.issue.ignore.multicriteria.h4.resourceKey=**/*
sonar.issue.ignore.multicriteria.h5.ruleKey=typescript:S4036
sonar.issue.ignore.multicriteria.h5.resourceKey=**/*
sonar.issue.ignore.multicriteria.h6.ruleKey=typescript:S1523
sonar.issue.ignore.multicriteria.h6.resourceKey=**/pluginWorker.ts