mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-15 19:32:20 +03:00
6e112d4b4f
GHSA-7434-6q4c-33fh: the OIDC callback validated the CSRF `state` cookie with `storedState !== returnedState`. `!==` short-circuits on the first differing byte, so rejection time correlates with matching-prefix length (CWE-208). The reporter scopes this honestly and so do we: `oidc_state` is a single-use per-login nonce, cleared immediately after validation, and recovering it would not by itself yield an authorization code. The reason to fix it is that this was the one callback in the repo still comparing a secret with `!==` — every sibling (the OAuth callback, the A2A token check, Telegram initData, the CLI token check) already compares in constant time — and an inconsistent pattern is one that gets copied into a context where it does matter. Which is exactly what had already happened: `isInternalAdmissionBypass()` gated an admission-lane bypass on `match[1].toLowerCase() === resolveSelfLoopBearer() .toLowerCase()`. That one guards a shared secret with real consequences, so it is fixed here too. Both now use `timingSafeCompare()` (src/shared/utils/timingSafeCompare.ts). The five lines it wraps were already copy-pasted into at least eight places; this is the shared one. The existing copies are left alone — consolidating them is a refactor, not a security fix, and does not belong in this diff. tests/unit/timing-safe-compare.test.ts — 6 tests, the two callsite guards red before the fix. The helper is covered for equal, differing-same-length, differing-length, null/undefined identity, and byte-exactness (precomposed vs decomposed "é" must not match). Closes GHSA-7434-6q4c-33fh