From 7c04e75e54f288cfbdca11175ddfab5ab20fe252 Mon Sep 17 00:00:00 2001 From: Diego Rodrigues de Sa e Souza Date: Fri, 28 Aug 2026 01:57:27 -0300 Subject: [PATCH] docs(dedup): correct the CodeQL claim on the tenant-namespace comment (#11712) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Obrigado! Correção honesta e bem documentada — só comentário, nenhuma mudança de lógica. - Corrige a alegação de que omitir `tenantId` do digest evita o falso-positivo do CodeQL `js/insufficient-password-hash`; documenta que o alerta #874 já foi levantado no `createHash` de qualquer forma e foi dispensado por HR#14 (documentação de segurança, não código). - Deixa explícito por que não "consertar" com um KDF: quebraria o determinismo de que o dedup depende. --- open-sse/services/requestDedup.ts | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/open-sse/services/requestDedup.ts b/open-sse/services/requestDedup.ts index b09b501164..fd3cfd7a36 100644 --- a/open-sse/services/requestDedup.ts +++ b/open-sse/services/requestDedup.ts @@ -141,8 +141,16 @@ function extractSystemContent(body: Record): unknown { * * It is a PLAINTEXT prefix rather than digest input, matching * `semanticCache.generateSignature` (#3740): the id is an internal namespace - * key, not a credential, and keeping it out of the digest avoids the - * false-positive CodeQL js/insufficient-password-hash on a cache/dedup key. + * key, not a credential, and a namespace you can read off the key is worth more + * than one you cannot when debugging a dedup collision. + * + * It does NOT dodge the CodeQL js/insufficient-password-hash false positive, + * which the #3740 comment claims for its own version and which this comment + * claimed too until alert #874 was raised on the `createHash` below anyway. + * Once an API-key-derived value reaches this file at all, the query flags the + * sibling digest regardless of what actually goes into it. Dismissed per HR#14; + * expect it to come back on any edit here, and do not "fix" it with a KDF — + * that would break the determinism dedup depends on. * * Omitting `tenantId` keeps the un-namespaced hash. Keyless local-first * deployments have no tenant boundary to preserve, and every such install would