mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-04 14:22:09 +03:00
0bd60f3fb2
* fix(cli): Windows cert check/uninstall key off the real CA identity, not a hardcoded legacy host (#7275) checkCertInstalledWindows()/uninstallCertWindows() queried the Windows Root store by the literal legacy hostname daily-cloudcode-pa.googleapis.com regardless of the certPath passed in (the check's param was even underscore-prefixed/unused). It only worked because that hostname happens to be the generated CA's own commonName today (generate.ts derives it from ANTIGRAVITY_TARGET.hosts[0]) -- a coincidence, not a derivation, with no shared symbol coupling the two. installCertWindows() was already correct. Both functions now derive a SHA-1 thumbprint straight from the certPath file via the new exported certutilThumbprint() helper (reusing the existing getCertFingerprint() logic checkCertInstalledMac() already keys off), so the Windows store lookup/delete always matches the real generated CA regardless of any future rename/reorder of ANTIGRAVITY_TARGET.hosts in generate.ts. Same anti-pattern class as #6338 (DNS side). * test(cli): assert certutil argv precisely instead of scanning for the legacy host (#7275) The two negative substring checks tripped CodeQL's js/incomplete-url-substring-sanitization (high) by looking like URL sanitization while actually asserting a certutil argv. Replaced with assertions on the exact argv / extracted certId, which are strictly stronger: pinning the value proves no other identity can be passed. Both still fail against the unfixed install.ts (5/5 RED) and pass with the fix (5/5 GREEN).