From c1ded0fbfa56b06840ed72a73986a45dc278eae7 Mon Sep 17 00:00:00 2001
From: Markus Hartung <mail@hartmark.se>
Date: Fri, 21 Aug 2026 07:46:20 -0300
Subject: [PATCH] fix(security): clear new CodeQL code-scanning alerts (round
 3)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- open-sse/executors/freebuff.ts: swap Math.random() for
  crypto.randomInt() when generating the client session id sent
  upstream — closes js/insecure-randomness with no behavior change
  (still a 13-char lowercase-alnum id).
- open-sse/executors/cursor/agentEndpoint.ts:104 — Cursor Agent RPC
  URL cache key fingerprint (already HMAC-SHA256): dismissed
  js/insufficient-password-hash, same rationale as PR #10739/#10888.
- open-sse/executors/cursor.ts:1229 — already routes through
  sanitizeErrorMessage(): dismissed js/stack-trace-exposure, known
  CodeQL limitation per HR#14 precedent.
- tests/unit/combo-silent-stop-gaps.test.ts:240 — the catastrophic
  (a+)+$ pattern is the intentional G7 test fixture proving the ReDoS
  guard rejects unsafe regexes: dismissed js/redos as "used in tests".
---
 open-sse/executors/freebuff.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/open-sse/executors/freebuff.ts b/open-sse/executors/freebuff.ts
index bc2de30f63..c2cf5bdbc3 100644
--- a/open-sse/executors/freebuff.ts
+++ b/open-sse/executors/freebuff.ts
@@ -1,3 +1,5 @@
+import { randomInt } from "node:crypto";
+
 import {
   BaseExecutor,
   type ExecuteInput,
@@ -20,7 +22,7 @@ function generateClientSessionId(): string {
   const alphabet = "0123456789abcdefghijklmnopqrstuvwxyz";
   let out = "";
   for (let i = 0; i < 13; i++) {
-    out += alphabet[Math.floor(Math.random() * alphabet.length)];
+    out += alphabet[randomInt(alphabet.length)];
   }
   return out;
 }