mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-31 04:12:10 +03:00
6fcc99ba26
CodeQL re-flagged the SHA-256 inside sessionPoolKey at high severity even after the rename/dedup in #2391 — its data-flow analysis still tracks the OAuth bearer (accessToken → token) into createHash and applies the js/insufficient-password-hash rule. Bcrypt/scrypt/argon2 would be wrong here (the input is a high-entropy bearer, not a low-entropy human password that needs brute-force protection). Switch to HMAC-SHA-256 with a process-scope key generated at startup (randomBytes(32)). HMAC is a MAC primitive, not a password hash, so the CodeQL rule no longer applies; uniqueness, determinism-within-process, and the 16-char hex shape all still hold, and as a small bonus an off-process attacker can no longer precompute pool keys from a token alone. Tests - Replace the "exact SHA-256 prefix" assertion with shape/uniqueness checks and a regression guard that fails if the implementation ever reverts to plain createHash. - All 15 copilot-web tests pass.