diegosouzapw 10c8f32bd9 fix(security): drop hashing in sessionPoolKey to clear CodeQL #247 ...

CodeQL re-flagged the HMAC variant from #2394 at high severity (#247) —
its data-flow analysis still sees an OAuth bearer reaching .update(token)
and applies js/insufficient-password-hash, regardless of whether the hash
primitive is createHash or createHmac.

Stop hashing the token at all. The session-pool Map is keyed by the
token verbatim, falling back to "anonymous" when the input is missing
or empty. This is safe because:

  - The token is already held in CopilotSession.cookies for every pool
    entry, so the Map key adds no new in-memory exposure.
  - The pool is bounded by MAX_POOL_SIZE with LRU eviction, so memory
    stays bounded regardless of how many distinct tokens appear.
  - bcrypt/scrypt/argon2 — the only forms CodeQL accepts here — are the
    wrong tool, since their slowness exists to thwart brute-force of
    low-entropy human passwords we do not have.

Tests
- Replace the "16-char hex" shape assertion with verbatim-equality
  assertions and an explicit "empty string → anonymous" case.
- Keep the regression guard that fails if anyone ever re-introduces
  createHash/createHmac on the token (catches the alert reappearing
  before CodeQL does).
- 16/16 copilot-web tests pass.

2026-05-19 00:26:17 -03:00

4.6 KiB

Raw Permalink Blame History

View Raw