mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-22 07:02:16 +03:00
3e046429a6
- open-sse/services/cursorApiKeyAuth.ts: switch the session-cache key fingerprint from sha256 to HMAC-SHA256 with a fixed context label — same pattern as PR #10739, avoids the js/insufficient-password-hash sink match while keeping the semantics correct for a cache key. - tests/unit/antigravity-byop-account-rotation.test.ts: replace the raw request.url.includes(hostname) mock-router check with new URL(...).hostname equality, closing the js/incomplete-url-substring-sanitization alert. - open-sse/executors/cursor.ts:739 already routes through sanitizeErrorMessage() (HR#12) — dismissed the js/stack-trace-exposure alert as a known CodeQL limitation (custom sanitizers not recognized), per HR#14 precedent.