OmniRoute

pjandro/OmniRoute

Fork 0

mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-03 13:52:09 +03:00

Commit Graph

Author	SHA1	Message	Date
diegosouzapw	34e62d8725	fix(security): crypto-secure cloud-agent IDs + exact-hostname check (CodeQL #251 , #252 ) - #251 (Insecure randomness): baseAgent.generateTaskId/generateActivityId used Math.random().toString(36) for IDs that flow into session/external identifiers (e.g. jules.ts task externalId). Switched to crypto randomBytes(8).toString("hex"). - #252 (Incomplete URL substring sanitization): the antigravity discovery test matched the upstream host via url.includes("…googleapis.com"), which a look-alike host could bypass. Switched to an exact `new URL(url).hostname === …` comparison.	2026-05-22 15:09:07 -03:00
Diego Rodrigues de Sa e Souza	91b6983564	Release v3.8.1 (#2441 ) Release v3.8.1 — feature flags settings page, bracketed combo names, security hardening, multi-driver SQLite	2026-05-21 01:29:12 -03:00
Anton	bbdcb97a06	fix(antigravity): bootstrap project via loadCodeAssist + fetchAvailableModels fallback (#2219 ) Integrated into release/v3.8.0	2026-05-14 00:09:26 -03:00

Author

SHA1

Message

Date

diegosouzapw

34e62d8725

fix(security): crypto-secure cloud-agent IDs + exact-hostname check (CodeQL #251 , #252 )

- #251 (Insecure randomness): baseAgent.generateTaskId/generateActivityId used
  Math.random().toString(36) for IDs that flow into session/external identifiers
  (e.g. jules.ts task externalId). Switched to crypto randomBytes(8).toString("hex").
- #252 (Incomplete URL substring sanitization): the antigravity discovery test
  matched the upstream host via url.includes("…googleapis.com"), which a look-alike
  host could bypass. Switched to an exact `new URL(url).hostname === …` comparison.

2026-05-22 15:09:07 -03:00

Diego Rodrigues de Sa e Souza

91b6983564

Release v3.8.1 (#2441 )

Release v3.8.1 — feature flags settings page, bracketed combo names, security hardening, multi-driver SQLite

2026-05-21 01:29:12 -03:00

Anton

bbdcb97a06

fix(antigravity): bootstrap project via loadCodeAssist + fetchAvailableModels fallback (#2219 )

Integrated into release/v3.8.0

2026-05-14 00:09:26 -03:00

3 Commits