diegosouzapw 58abfb4d57 fix(security): reject unverifiable X-Cloud-Sig in cloud-sync HMAC check (#13679 PR A) ...

verifyCloudSignature() previously fell open whenever OMNIROUTE_CLOUD_SYNC_SECRET
was unset: any X-Cloud-Sig header, including a forged/garbage one, was accepted
unconditionally. A MITM on the CLOUD_URL channel (or a compromised/misconfigured
CLOUD_URL) could send an arbitrary signature and have it accepted.

Per the owner's decision on the #13679 umbrella (PR A): a PRESENT-but-unverifiable
signature is now rejected outright, regardless of any flag. A new opt-in
OMNIROUTE_CLOUD_SYNC_ENFORCE_SIGNATURE=true flag (default OFF) also rejects an
ABSENT signature, bringing the v3.9 enforce-by-default plan forward early without
breaking v3.8.x peers that haven't rotated in a shared secret yet.

Regression test: tests/unit/security/cloudsync-signature-fail-open-13679.test.ts

2026-09-15 19:01:15 -03:00

..

build-profile-stubs.test.ts

…

cloud-sync-hmac.test.ts

…

cloudsync-signature-fail-open-13679.test.ts

…

docs-path-traversal.test.ts

…

docs-sanitization.test.ts

…

elevated-powershell-no-encoded.test.ts

…

live-server-allowlist.test.ts

…

local-endpoints.test.ts

…

zed-credential-fingerprint.test.ts

…

zed-import-two-step.test.ts

…