pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-17 12:42:21 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): keep only the regex sanitization; drop non-functional CodeQL annotations

Browse Source 
The lgtm[]/nosemgrep: comments in codexIdentity.ts and reasoningCache.ts use
formats GitHub Actions CodeQL does not honor, and shifting those sha256 lines
re-attributed the already-dismissed base alerts to this PR as two new CodeQL
findings. Revert those two annotation-only files to base so the existing
dismissals apply; retain the real fix (escaping backslash in the test regex),
which resolves the open js/incomplete-sanitization alert.
This commit is contained in:
adevwithpurpose
2026-08-15 10:08:14 -03:00
parent 864e817eda
commit af6813ca12
2 changed files with 5 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
open-sse/config/codexIdentity.ts
View File

@@ -37,26 +37,15 @@ function nonEmptyString(value: unknown): string | null {
return normalized || null;
}
/**
* Keep the historical installation-id layout so existing accounts stay stable.
* CodeQL: not password hashing — this derives a deterministic installation UUID
* from an account seed, never verified against a stored credential. Same
* false-positive class as src/lib/db/apiKeys.ts::hashKey.
* lgtm[js/insufficient-password-hash]
*/
/** Keep the historical installation-id layout so existing accounts stay stable. */
function uuidFromLegacyInstallationValue(value: string): string {
const hash = createHash("sha256").update(value).digest("hex"); // nosemgrep: insufficient-password-hash
const hash = createHash("sha256").update(value).digest("hex");
return `${hash.slice(0, 8)}-${hash.slice(8, 12)}-4${hash.slice(13, 16)}-a${hash.slice(17, 20)}-${hash.slice(20, 32)}`;
}
/**
* RFC4122 v4 from SHA-256. Same seed → same UUID.
* CodeQL: not password hashing — deterministic ID derivation from an account
* seed, never verified against a stored credential.
* lgtm[js/insufficient-password-hash]
*/
/** RFC4122 v4 from SHA-256. Same seed → same UUID. */
export function deriveStableUUIDv4(seed: string): string {
const digest = createHash("sha256").update(seed).digest(); // nosemgrep: insufficient-password-hash
const digest = createHash("sha256").update(seed).digest();
const bytes = Buffer.from(digest.subarray(0, 16));
bytes[6] = (bytes[6] & 0x0f) | 0x40;
bytes[8] = (bytes[8] & 0x3f) | 0x80;

6
open-sse/services/reasoningCache.ts
View File

@@ -302,11 +302,7 @@ export function buildAssistantMessageCacheKey(
if (!message || message.role !== "assistant") return "";
const transcript = messages.slice(0, messageIndex + 1).map(canonicalizeHistoryMessage);
// CodeQL: not password hashing — this derives a cache-lookup key from the
// conversation transcript, never verified against a stored credential.
// Same false-positive class as src/lib/db/apiKeys.ts::hashKey.
// lgtm[js/insufficient-password-hash]
const digest = createHash("sha256") // nosemgrep: insufficient-password-hash
const digest = createHash("sha256")
.update(normalizedScope)
.update("\x1f")
.update(JSON.stringify(transcript))