mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-31 04:12:10 +03:00
10c8f32bd9
CodeQL re-flagged the HMAC variant from #2394 at high severity (#247) — its data-flow analysis still sees an OAuth bearer reaching .update(token) and applies js/insufficient-password-hash, regardless of whether the hash primitive is createHash or createHmac. Stop hashing the token at all. The session-pool Map is keyed by the token verbatim, falling back to "anonymous" when the input is missing or empty. This is safe because: - The token is already held in CopilotSession.cookies for every pool entry, so the Map key adds no new in-memory exposure. - The pool is bounded by MAX_POOL_SIZE with LRU eviction, so memory stays bounded regardless of how many distinct tokens appear. - bcrypt/scrypt/argon2 — the only forms CodeQL accepts here — are the wrong tool, since their slowness exists to thwart brute-force of low-entropy human passwords we do not have. Tests - Replace the "16-char hex" shape assertion with verbatim-equality assertions and an explicit "empty string → anonymous" case. - Keep the regression guard that fails if anyone ever re-introduces createHash/createHmac on the token (catches the alert reappearing before CodeQL does). - 16/16 copilot-web tests pass.