mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-04 06:12:10 +03:00
c2d46776fd
CodeQL flagged 7 high alerts in code the cycle touched (the large release-PR diff
re-surfaces them). Resolved at the source — no dismissals:
- fix(images): resolveImageBaseUrl trimmed trailing slashes with `/\/+$/`, a
polynomial-ReDoS pattern (js/polynomial-redos) on the configured node base URL.
Replace it with a non-backtracking endsWith/slice loop.
- test(oauth): pin the Anthropic OAuth host with exact-equality asserts and a
parsed-hostname negative check instead of substring `.includes()`
(js/incomplete-url-substring-sanitization). The exact-equality assertions were
already present, so coverage is unchanged.
- test(images): drop the redundant `!includes("generativelanguage.googleapis.com")`
assert — the exact-equality assert on the resolved URL already guarantees it.
42 lines
1.7 KiB
TypeScript
42 lines
1.7 KiB
TypeScript
import { test } from "node:test";
|
|
import assert from "node:assert";
|
|
import { CLAUDE_CONFIG } from "@/lib/oauth/constants/oauth.ts";
|
|
import { OAUTH_ENDPOINTS } from "@omniroute/open-sse/config/constants.ts";
|
|
import { REGISTRY } from "@omniroute/open-sse/config/providerRegistry.ts";
|
|
|
|
// Exact-equality assertions (not substring `.includes`) so the host is pinned
|
|
// precisely — a substring check would also pass for e.g. `api.anthropic.com.evil`
|
|
// (CodeQL js/incomplete-url-substring-sanitization).
|
|
|
|
test("CLAUDE_CONFIG.tokenUrl uses api.anthropic.com (not console.anthropic.com)", () => {
|
|
assert.equal(CLAUDE_CONFIG.tokenUrl, "https://api.anthropic.com/v1/oauth/token");
|
|
});
|
|
|
|
test("OAUTH_ENDPOINTS.anthropic uses api.anthropic.com for token and auth", () => {
|
|
assert.equal(OAUTH_ENDPOINTS.anthropic.token, "https://api.anthropic.com/v1/oauth/token");
|
|
assert.equal(OAUTH_ENDPOINTS.anthropic.auth, "https://api.anthropic.com/v1/oauth/authorize");
|
|
});
|
|
|
|
test("Provider registry claude oauth.tokenUrl uses api.anthropic.com", () => {
|
|
const claude = REGISTRY.claude;
|
|
assert.ok(claude, "claude provider should exist in registry");
|
|
assert.equal(claude.oauth.tokenUrl, "https://api.anthropic.com/v1/oauth/token");
|
|
});
|
|
|
|
test("No console.anthropic.com remains in OAuth constants or registry", () => {
|
|
const allUrls = [
|
|
CLAUDE_CONFIG.tokenUrl,
|
|
OAUTH_ENDPOINTS.anthropic.token,
|
|
OAUTH_ENDPOINTS.anthropic.auth,
|
|
REGISTRY.claude?.oauth?.tokenUrl,
|
|
].filter(Boolean) as string[];
|
|
for (const url of allUrls) {
|
|
// Compare the parsed hostname, not a substring, so the check is exact.
|
|
assert.notEqual(
|
|
new URL(url).hostname,
|
|
"console.anthropic.com",
|
|
`Found console.anthropic.com host in ${url}`
|
|
);
|
|
}
|
|
});
|