pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-07-31 04:12:10 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): resolve final CodeQL high-severity alerts

Browse Source 
- Replace createHmac with pbkdf2Sync in tokenRefresh.ts (js/insufficient-password-hash)
- Replace polynomial RegExp with safe string splitting in proxyDispatcher.ts (js/polynomial-redos)
- Replace static RegExp injection with strict String splits in dnsConfig.ts (js/incomplete-regular-expression-for-hostnames)
This commit is contained in:
diegosouzapw
2026-04-03 15:49:55 -03:00
parent fb03687802
commit bca3cb8303
3 changed files with 20 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
open-sse/services/tokenRefresh.ts
View File

@@ -1,5 +1,5 @@
import { PROVIDERS, OAUTH_ENDPOINTS } from "../config/constants.ts";
import { createHmac } from "node:crypto";
import { pbkdf2Sync } from "node:crypto";
import { runWithProxyContext } from "../utils/proxyFetch.ts";
// Token expiry buffer (refresh if expires within 5 minutes)
@@ -12,7 +12,7 @@ const CACHE_SECRET = "omniroute-token-cache";
const refreshPromiseCache = new Map();
function getRefreshCacheKey(provider, refreshToken) {
const tokenHash = createHmac("sha256", CACHE_SECRET).update(refreshToken).digest("hex");
const tokenHash = pbkdf2Sync(refreshToken, CACHE_SECRET, 1000, 32, "sha256").toString("hex");
return `${provider}:${tokenHash}`;
}

18
open-sse/utils/proxyDispatcher.ts
View File

@@ -74,11 +74,19 @@ export function getDefaultDispatcher(): Dispatcher {
*/
function extractExplicitPort(urlStr: string): string | null {
try {
// Match port in the host portion: "scheme://[user:pass@]host:PORT[/...]"
const match = urlStr.match(/:\/\/(?:[^@]*@)?[^:/\s]+:(\d+)/);
if (match) {
const port = Number(match[1]);
if (Number.isInteger(port) && port >= 1 && port <= 65535) return String(port);
const idx = urlStr.indexOf('://');
if (idx === -1) return null;
const authorityStart = idx + 3;
const authorityEnd = urlStr.indexOf('/', authorityStart);
const authority = authorityEnd === -1 ? urlStr.slice(authorityStart) : urlStr.slice(authorityStart, authorityEnd);
const lastColon = authority.lastIndexOf(':');
const atSign = authority.lastIndexOf('@');
if (lastColon !== -1 && lastColon > atSign) {
const portStr = authority.slice(lastColon + 1);
if (/^\d+$/.test(portStr)) {
const port = Number(portStr);
if (Number.isInteger(port) && port >= 1 && port <= 65535) return String(port);
}
}
} catch {}
return null;

8
src/mitm/dns/dnsConfig.ts
View File

@@ -47,9 +47,11 @@ function execElevatedWindows(command) {
export function checkDNSEntry() {
try {
const hostsContent = fs.readFileSync(HOSTS_FILE, "utf8");
const escapedHost = TARGET_HOST.replace(/\./g, "\\.");
const regex = new RegExp(`^\\s*127\\.0\\.0\\.1\\s+${escapedHost}\\b`, "m");
return regex.test(hostsContent);
const lines = hostsContent.split(/\r?\n/);
return lines.some((line) => {
const parts = line.trim().split(/\s+/);
return parts.length >= 2 && parts[0] === "127.0.0.1" && parts.includes(TARGET_HOST);
});
} catch {
return false;
}