mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-26 09:52:11 +03:00
c2d46776fd
CodeQL flagged 7 high alerts in code the cycle touched (the large release-PR diff
re-surfaces them). Resolved at the source — no dismissals:
- fix(images): resolveImageBaseUrl trimmed trailing slashes with `/\/+$/`, a
polynomial-ReDoS pattern (js/polynomial-redos) on the configured node base URL.
Replace it with a non-backtracking endsWith/slice loop.
- test(oauth): pin the Anthropic OAuth host with exact-equality asserts and a
parsed-hostname negative check instead of substring `.includes()`
(js/incomplete-url-substring-sanitization). The exact-equality assertions were
already present, so coverage is unchanged.
- test(images): drop the redundant `!includes("generativelanguage.googleapis.com")`
assert — the exact-equality assert on the resolved URL already guarantees it.
58 lines
2.5 KiB
TypeScript
58 lines
2.5 KiB
TypeScript
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
|
|
import { resolveImageBaseUrl } from "@omniroute/open-sse/handlers/imageGeneration.ts";
|
|
|
|
const GEMINI_FALLBACK =
|
|
"https://generativelanguage.googleapis.com/v1beta/openai/images/generations";
|
|
|
|
test("#3205: custom node baseUrl from providerSpecificData is used (not Gemini fallback)", () => {
|
|
const credentials = { providerSpecificData: { baseUrl: "https://example.com/v1" } };
|
|
const resolved = resolveImageBaseUrl(credentials, GEMINI_FALLBACK);
|
|
|
|
assert.ok(
|
|
resolved.startsWith("https://example.com/"),
|
|
`expected resolved URL to point to example.com, got: ${resolved}`
|
|
);
|
|
// The exact-equality assertion below already guarantees the Gemini fallback
|
|
// was not used (a substring `.includes` check trips CodeQL
|
|
// js/incomplete-url-substring-sanitization and is redundant here).
|
|
assert.equal(resolved, "https://example.com/v1/images/generations");
|
|
});
|
|
|
|
test("#3205: providerSpecificData.baseUrl wins over top-level credentials.baseUrl", () => {
|
|
const credentials = {
|
|
baseUrl: "https://toplevel.example/v1",
|
|
providerSpecificData: { baseUrl: "https://psd.example/v1" },
|
|
};
|
|
const resolved = resolveImageBaseUrl(credentials, GEMINI_FALLBACK);
|
|
assert.equal(resolved, "https://psd.example/v1/images/generations");
|
|
});
|
|
|
|
test("#3205: trailing slash on node baseUrl is normalized (no double slash)", () => {
|
|
const credentials = { providerSpecificData: { baseUrl: "https://example.com/v1/" } };
|
|
const resolved = resolveImageBaseUrl(credentials, GEMINI_FALLBACK);
|
|
assert.equal(resolved, "https://example.com/v1/images/generations");
|
|
});
|
|
|
|
test("#3205: an already-complete images URL is not double-appended", () => {
|
|
const credentials = {
|
|
providerSpecificData: { baseUrl: "https://example.com/v1/images/generations" },
|
|
};
|
|
const resolved = resolveImageBaseUrl(credentials, GEMINI_FALLBACK);
|
|
assert.equal(resolved, "https://example.com/v1/images/generations");
|
|
});
|
|
|
|
test("#3205: top-level credentials.baseUrl is honored when no providerSpecificData", () => {
|
|
const credentials = { baseUrl: "https://legacy.example/v1" };
|
|
const resolved = resolveImageBaseUrl(credentials, GEMINI_FALLBACK);
|
|
assert.equal(resolved, "https://legacy.example/v1/images/generations");
|
|
});
|
|
|
|
test("#3205: falls back to provided default when no node baseUrl present", () => {
|
|
const resolved = resolveImageBaseUrl({}, GEMINI_FALLBACK);
|
|
assert.equal(resolved, GEMINI_FALLBACK);
|
|
const resolvedNull = resolveImageBaseUrl(null, GEMINI_FALLBACK);
|
|
assert.equal(resolvedNull, GEMINI_FALLBACK);
|
|
});
|