pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-19 21:52:21 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(codeql): suppress js/insufficient-password-hash false positive in lane-key fingerprinting (#10039)

Browse Source 
resolveSessionId sha256-hashes bearer/x-api-key/x-goog-api-key to derive a deterministic, non-reversible per-key lane-bucket ID for virtual admission lanes (#9654). This is not password storage or verification, so the rule is a false positive; suppress it inline (same house style as src/lib/sync/tokens.ts) to clear the codeqlAlerts ratchet (2 > baseline 1) that blocks #10039 and every PR against release/v3.8.50.
This commit is contained in:
Brandon Bennett
2026-08-10 11:07:35 -07:00
parent 3368fa8408
commit c806a7494d
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/shared/middleware/chatBodyAdmission.ts
View File

@@ -334,18 +334,25 @@ export function resolveSessionId(request: Request): string {
// material never appears in diagnostics. Reuses the internal-bypass auth
// extraction: bearer token from Authorization, x-api-key (Anthropic-style),
// or Google API key header.
// CodeQL: Intentionally SHA-256, NOT password hashing. The digest is a
// deterministic, non-reversible per-key fairness key for the shared
// admission budget — never stored or used for password-style verification.
// codeql[js/insufficient-password-hash]
const authHeader = request.headers.get("authorization") || "";
const bearerMatch = /^bearer\s+(\S+)$/i.exec(authHeader.trim());
if (bearerMatch) {
return "key_" + createHash("sha256").update(bearerMatch[1]).digest("hex").slice(0, 16);
// codeql[js/insufficient-password-hash]
return "key_" + createHash("sha256").update(bearerMatch[1]).digest("hex").slice(0, 16); // nosemgrep: insufficient-password-hash
}
const xApiKey = request.headers.get("x-api-key") || "";
if (xApiKey.trim().length > 0) {
return "key_" + createHash("sha256").update(xApiKey.trim()).digest("hex").slice(0, 16);
// codeql[js/insufficient-password-hash]
return "key_" + createHash("sha256").update(xApiKey.trim()).digest("hex").slice(0, 16); // nosemgrep: insufficient-password-hash
}
const xGoogApiKey = request.headers.get("x-goog-api-key") || "";
if (xGoogApiKey.trim().length > 0) {
return "key_" + createHash("sha256").update(xGoogApiKey.trim()).digest("hex").slice(0, 16);
// codeql[js/insufficient-password-hash]
return "key_" + createHash("sha256").update(xGoogApiKey.trim()).digest("hex").slice(0, 16); // nosemgrep: insufficient-password-hash
}
return "anonymous";
}