From c806a7494df7d05eef3f711e49b5e209d7773dad Mon Sep 17 00:00:00 2001 From: Brandon Bennett Date: Mon, 10 Aug 2026 11:07:35 -0700 Subject: [PATCH] fix(codeql): suppress js/insufficient-password-hash false positive in lane-key fingerprinting (#10039) resolveSessionId sha256-hashes bearer/x-api-key/x-goog-api-key to derive a deterministic, non-reversible per-key lane-bucket ID for virtual admission lanes (#9654). This is not password storage or verification, so the rule is a false positive; suppress it inline (same house style as src/lib/sync/tokens.ts) to clear the codeqlAlerts ratchet (2 > baseline 1) that blocks #10039 and every PR against release/v3.8.50. --- src/shared/middleware/chatBodyAdmission.ts | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/src/shared/middleware/chatBodyAdmission.ts b/src/shared/middleware/chatBodyAdmission.ts index e85fce30ec..bbe8e54387 100644 --- a/src/shared/middleware/chatBodyAdmission.ts +++ b/src/shared/middleware/chatBodyAdmission.ts @@ -334,18 +334,25 @@ export function resolveSessionId(request: Request): string { // material never appears in diagnostics. Reuses the internal-bypass auth // extraction: bearer token from Authorization, x-api-key (Anthropic-style), // or Google API key header. + // CodeQL: Intentionally SHA-256, NOT password hashing. The digest is a + // deterministic, non-reversible per-key fairness key for the shared + // admission budget — never stored or used for password-style verification. + // codeql[js/insufficient-password-hash] const authHeader = request.headers.get("authorization") || ""; const bearerMatch = /^bearer\s+(\S+)$/i.exec(authHeader.trim()); if (bearerMatch) { - return "key_" + createHash("sha256").update(bearerMatch[1]).digest("hex").slice(0, 16); + // codeql[js/insufficient-password-hash] + return "key_" + createHash("sha256").update(bearerMatch[1]).digest("hex").slice(0, 16); // nosemgrep: insufficient-password-hash } const xApiKey = request.headers.get("x-api-key") || ""; if (xApiKey.trim().length > 0) { - return "key_" + createHash("sha256").update(xApiKey.trim()).digest("hex").slice(0, 16); + // codeql[js/insufficient-password-hash] + return "key_" + createHash("sha256").update(xApiKey.trim()).digest("hex").slice(0, 16); // nosemgrep: insufficient-password-hash } const xGoogApiKey = request.headers.get("x-goog-api-key") || ""; if (xGoogApiKey.trim().length > 0) { - return "key_" + createHash("sha256").update(xGoogApiKey.trim()).digest("hex").slice(0, 16); + // codeql[js/insufficient-password-hash] + return "key_" + createHash("sha256").update(xGoogApiKey.trim()).digest("hex").slice(0, 16); // nosemgrep: insufficient-password-hash } return "anonymous"; }