OmniRoute

pjandro/OmniRoute

Fork 0

mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-02 05:12:11 +03:00

Commit Graph

Author	SHA1	Message	Date
diegosouzapw	a45d9190db	fix(security): resolve CodeQL ReDoS + URL sanitization alerts - Replace replace(/\/+$/, "") with explicit while-endsWith loop to avoid polynomial backtracking on inputs with repeated trailing slashes (CodeQL js/polynomial-redos #233-240, 8 alerts): - @omniroute/opencode-provider/src/index.ts (normalizeBaseURL) - bin/cli/api.mjs (stripTrailingSlash) - src/lib/cli-helper/config-generator/{claude,cline,codex,continue, kilocode,opencode}.ts (6 generators with identical pattern) - tests/live/deepseek-web-live.test.ts: assert hostname via URL parsing instead of String.includes() so the check is exact-match rather than substring (CodeQL js/incomplete-url-substring-sanitization #241). Alert #242 (Array.prototype.includes against fixed needle constant OPENWEBUI_PARAGRAPH_ANCHORS) dismissed as CodeQL false-positive — not a URL sanitization callsite.	2026-05-17 07:43:32 -03:00
diegosouzapw	96e528e3e2	feat(cli): fase 8.2/8.12 — update-notifier e CLI machine-id token - 8.2: update-notifier em omniroute.mjs (cache 24h, stderr-only, respeita CI/quiet/json/opt-out) - 8.12: cliToken.mjs (sha256 de machineId + salt) injetado automaticamente em apiFetch - 8.12: middleware cliTokenAuth.ts valida token apenas em loopback, timing-safe compare - 8.12: requireManagementAuth aceita CLI token como bypass local - env-doc-sync: OMNIROUTE_DISABLE_CLI_TOKEN e OMNIROUTE_NO_UPDATE_NOTIFIER no allowlist	2026-05-15 03:13:06 -03:00
diegosouzapw	2e494f8f07	feat(cli): Fase 0.3 — helpers base + convenções (api, i18n, output, runtime) - bin/cli/CONVENTIONS.md: fonte normativa de flags, exit codes, output, retry/backoff, i18n, secrets, auditoria de ações destrutivas - bin/cli/api.mjs: apiFetch() com retry/backoff, Retry-After, ApiError, statusToExitCode, isServerUp; computeBackoff/shouldRetryStatus exportados - bin/cli/runtime.mjs: withRuntime/withHttp/withDb — server-first / DB-fallback; ServerOfflineError com exitCode 3 - bin/cli/i18n.mjs: t() com Map achatado (sem bracket em prototype), interpolação {vars}, setLocale/detectLocale/resetForTests; hardened contra __proto__ traversal - bin/cli/output.mjs: emit() (table/json/jsonl/csv), EXIT_CODES, maskSecret, printSuccess/printError/printWarning/exitWith; output → stdout, diagnóstico → stderr - bin/cli/locales/en.json + pt-BR.json: strings base (setup/doctor/providers/ keys/combo/serve/backup/update/health/mcp/tunnel) - bin/cli/README.md: mapa da estrutura e guia de uso dos helpers - tests/unit/cli-exit-codes.test.ts: 10 casos — EXIT_CODES, statusToExitCode, backoff exponencial, jitter ±25%, t() i18n com pt-BR e anti-__proto__ - .env.example + docs/reference/ENVIRONMENT.md: documentar 4 novas env vars CLI (OMNIROUTE_LANG, OMNIROUTE_CLI_TOKEN, OMNIROUTE_HTTP_TIMEOUT_MS, OMNIROUTE_VERBOSE) - scripts/check/check-env-doc-sync.mjs: adicionar LC_MESSAGES ao allowlist de sistema	2026-05-14 21:42:57 -03:00

Author

SHA1

Message

Date

diegosouzapw

a45d9190db

fix(security): resolve CodeQL ReDoS + URL sanitization alerts

- Replace replace(/\/+$/, "") with explicit while-endsWith loop to avoid
  polynomial backtracking on inputs with repeated trailing slashes
  (CodeQL js/polynomial-redos #233-240, 8 alerts):
  - @omniroute/opencode-provider/src/index.ts (normalizeBaseURL)
  - bin/cli/api.mjs (stripTrailingSlash)
  - src/lib/cli-helper/config-generator/{claude,cline,codex,continue,
    kilocode,opencode}.ts (6 generators with identical pattern)

- tests/live/deepseek-web-live.test.ts: assert hostname via URL parsing
  instead of String.includes() so the check is exact-match rather than
  substring (CodeQL js/incomplete-url-substring-sanitization #241).

Alert #242 (Array.prototype.includes against fixed needle constant
OPENWEBUI_PARAGRAPH_ANCHORS) dismissed as CodeQL false-positive — not a
URL sanitization callsite.

2026-05-17 07:43:32 -03:00

diegosouzapw

96e528e3e2

feat(cli): fase 8.2/8.12 — update-notifier e CLI machine-id token

- 8.2: update-notifier em omniroute.mjs (cache 24h, stderr-only, respeita CI/quiet/json/opt-out)
- 8.12: cliToken.mjs (sha256 de machineId + salt) injetado automaticamente em apiFetch
- 8.12: middleware cliTokenAuth.ts valida token apenas em loopback, timing-safe compare
- 8.12: requireManagementAuth aceita CLI token como bypass local
- env-doc-sync: OMNIROUTE_DISABLE_CLI_TOKEN e OMNIROUTE_NO_UPDATE_NOTIFIER no allowlist

2026-05-15 03:13:06 -03:00

diegosouzapw

2e494f8f07

feat(cli): Fase 0.3 — helpers base + convenções (api, i18n, output, runtime)

- bin/cli/CONVENTIONS.md: fonte normativa de flags, exit codes, output,
  retry/backoff, i18n, secrets, auditoria de ações destrutivas
- bin/cli/api.mjs: apiFetch() com retry/backoff, Retry-After, ApiError,
  statusToExitCode, isServerUp; computeBackoff/shouldRetryStatus exportados
- bin/cli/runtime.mjs: withRuntime/withHttp/withDb — server-first / DB-fallback;
  ServerOfflineError com exitCode 3
- bin/cli/i18n.mjs: t() com Map achatado (sem bracket em prototype), interpolação
  {vars}, setLocale/detectLocale/resetForTests; hardened contra __proto__ traversal
- bin/cli/output.mjs: emit() (table/json/jsonl/csv), EXIT_CODES, maskSecret,
  printSuccess/printError/printWarning/exitWith; output → stdout, diagnóstico → stderr
- bin/cli/locales/en.json + pt-BR.json: strings base (setup/doctor/providers/
  keys/combo/serve/backup/update/health/mcp/tunnel)
- bin/cli/README.md: mapa da estrutura e guia de uso dos helpers
- tests/unit/cli-exit-codes.test.ts: 10 casos — EXIT_CODES, statusToExitCode,
  backoff exponencial, jitter ±25%, t() i18n com pt-BR e anti-__proto__
- .env.example + docs/reference/ENVIRONMENT.md: documentar 4 novas env vars CLI
  (OMNIROUTE_LANG, OMNIROUTE_CLI_TOKEN, OMNIROUTE_HTTP_TIMEOUT_MS, OMNIROUTE_VERBOSE)
- scripts/check/check-env-doc-sync.mjs: adicionar LC_MESSAGES ao allowlist de sistema

2026-05-14 21:42:57 -03:00

3 Commits