mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-15 03:12:36 +03:00
18fceaf8d4
The comment added in #11649 said keeping the API key id out of the digest "avoids the false-positive CodeQL js/insufficient-password-hash on a cache/dedup key". It does not. CodeQL raised alert #874 on the `createHash` in this very function on the first scan after that merge: once an API-key-derived value reaches the file at all, the query flags the sibling digest regardless of what goes into it. The plaintext prefix is still the right call — a namespace you can read off the key beats one you cannot when debugging a dedup collision, and it matches `semanticCache.generateSignature` (#3740), whose comment makes the same incorrect claim. But a rationale that is measurably false is worse than no rationale: the next person edits here, sees the alert the comment promised would not happen, and doubts the design instead of the comment. Replaced with what actually holds, plus the two things worth knowing: the alert is dismissed per HR#14 and will come back on any edit here, and it must not be "fixed" with a KDF — that would break the determinism dedup depends on. Comment-only. No behaviour change; request-dedup tests 15/15.