mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-18 13:14:56 +03:00
6e71553797
* perf(db): project columns + composite index in getProviderConnections - Add param to avoid (scans ~200MB/query) - Add WHERE clause support (was silently ignored) - Add composite index on (auth_type, is_active, refresh_token) - Update health check caller to request only needed columns - Test: authType filter, column projection, default full fetch * fix(db): dedupe authType filter, allowlist columns projection in getProviderConnections The branch was rebased on top of #6946 (already merged, same author, same authType-filter fix), leaving a duplicate `if (filter.authType)` block in getProviderConnections. Harmless at runtime (SQLite tolerates the repeated named param) but dead code — remove the newer duplicate, keep the one already merged via #6946. The `columns` projection param is interpolated directly into the SQL SELECT clause via `.join(", ")` with no validation. No current caller passes untrusted input, but it's a live SQL-injection footgun for whichever future caller wires it up: reproduced a working exfiltration via a single-statement subquery column name (no semicolon/stacked-query needed, so better-sqlite3's single-statement restriction doesn't help) that leaked an unrelated connection's api_key through the response. Add an allowlist validated against the real provider_connections schema (core.ts's SCHEMA_SQL) — rejects any non-listed column, and re-quotes the reserved "group" keyword so it stays usable. Verified the fix blocks the exact reproduced exfiltration. Add a regression test asserting invalid/injection-shaped column names are rejected, a mixed valid+invalid list still rejects (fail-closed, not a silent partial projection), and the legitimate "group" column still round-trips correctly when requested. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: oyi77 <oyi77@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>