mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-16 04:03:02 +03:00
266ffc9756
Two real defects surfaced by the 2026-08-12 code-scanning triage. decodeXmlText decoded `&` before `"`/`'`, so `"` — the encoding of the literal text `"` — collapsed to `"` in a second pass. The decoded values feed the workspace-root trust comparison in parseTrustedCodexEnvironment, so an encoded path could decode into a different path than the client declared. Decoding `&` last fixes it. The tinycms nonce fell back to `Date.now()` plus a non-cryptographic PRNG when `crypto.randomUUID` was absent. That nonce is signed into the provider's anti-replay payload, so the fallback produced a predictable value silently. It is now always `randomUUID()` from node:crypto, which is present on every supported runtime. Both guards are mutation-validated: reverting either fix makes the new test fail. Refs #9985