From bca3cb83035b0ce3a71e9cb5309223cb1c824316 Mon Sep 17 00:00:00 2001
From: diegosouzapw <diegosouzapw@users.noreply.github.com>
Date: Fri, 3 Apr 2026 15:49:55 -0300
Subject: [PATCH] fix(security): resolve final CodeQL high-severity alerts

- Replace createHmac with pbkdf2Sync in tokenRefresh.ts (js/insufficient-password-hash)
- Replace polynomial RegExp with safe string splitting in proxyDispatcher.ts (js/polynomial-redos)
- Replace static RegExp injection with strict String splits in dnsConfig.ts (js/incomplete-regular-expression-for-hostnames)
---
 open-sse/services/tokenRefresh.ts |  4 ++--
 open-sse/utils/proxyDispatcher.ts | 18 +++++++++++++-----
 src/mitm/dns/dnsConfig.ts         |  8 +++++---
 3 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/open-sse/services/tokenRefresh.ts b/open-sse/services/tokenRefresh.ts
index 579fca9016..a39bd3f4e8 100755
--- a/open-sse/services/tokenRefresh.ts
+++ b/open-sse/services/tokenRefresh.ts
@@ -1,5 +1,5 @@
 import { PROVIDERS, OAUTH_ENDPOINTS } from "../config/constants.ts";
-import { createHmac } from "node:crypto";
+import { pbkdf2Sync } from "node:crypto";
 import { runWithProxyContext } from "../utils/proxyFetch.ts";
 
 // Token expiry buffer (refresh if expires within 5 minutes)
@@ -12,7 +12,7 @@ const CACHE_SECRET = "omniroute-token-cache";
 const refreshPromiseCache = new Map();
 
 function getRefreshCacheKey(provider, refreshToken) {
-  const tokenHash = createHmac("sha256", CACHE_SECRET).update(refreshToken).digest("hex");
+  const tokenHash = pbkdf2Sync(refreshToken, CACHE_SECRET, 1000, 32, "sha256").toString("hex");
   return `${provider}:${tokenHash}`;
 }
 
diff --git a/open-sse/utils/proxyDispatcher.ts b/open-sse/utils/proxyDispatcher.ts
index 055c388b84..07c73fad97 100644
--- a/open-sse/utils/proxyDispatcher.ts
+++ b/open-sse/utils/proxyDispatcher.ts
@@ -74,11 +74,19 @@ export function getDefaultDispatcher(): Dispatcher {
  */
 function extractExplicitPort(urlStr: string): string | null {
   try {
-    // Match port in the host portion: "scheme://[user:pass@]host:PORT[/...]"
-    const match = urlStr.match(/:\/\/(?:[^@]*@)?[^:/\s]+:(\d+)/);
-    if (match) {
-      const port = Number(match[1]);
-      if (Number.isInteger(port) && port >= 1 && port <= 65535) return String(port);
+    const idx = urlStr.indexOf('://');
+    if (idx === -1) return null;
+    const authorityStart = idx + 3;
+    const authorityEnd = urlStr.indexOf('/', authorityStart);
+    const authority = authorityEnd === -1 ? urlStr.slice(authorityStart) : urlStr.slice(authorityStart, authorityEnd);
+    const lastColon = authority.lastIndexOf(':');
+    const atSign = authority.lastIndexOf('@');
+    if (lastColon !== -1 && lastColon > atSign) {
+      const portStr = authority.slice(lastColon + 1);
+      if (/^\d+$/.test(portStr)) {
+        const port = Number(portStr);
+        if (Number.isInteger(port) && port >= 1 && port <= 65535) return String(port);
+      }
     }
   } catch {}
   return null;
diff --git a/src/mitm/dns/dnsConfig.ts b/src/mitm/dns/dnsConfig.ts
index 49ec0e3f5e..f4a41c3c3d 100644
--- a/src/mitm/dns/dnsConfig.ts
+++ b/src/mitm/dns/dnsConfig.ts
@@ -47,9 +47,11 @@ function execElevatedWindows(command) {
 export function checkDNSEntry() {
   try {
     const hostsContent = fs.readFileSync(HOSTS_FILE, "utf8");
-    const escapedHost = TARGET_HOST.replace(/\./g, "\\.");
-    const regex = new RegExp(`^\\s*127\\.0\\.0\\.1\\s+${escapedHost}\\b`, "m");
-    return regex.test(hostsContent);
+    const lines = hostsContent.split(/\r?\n/);
+    return lines.some((line) => {
+      const parts = line.trim().split(/\s+/);
+      return parts.length >= 2 && parts[0] === "127.0.0.1" && parts.includes(TARGET_HOST);
+    });
   } catch {
     return false;
   }