Files
OmniRoute/tests/unit
diegosouzapw 6fcc99ba26 fix(security): switch sessionPoolKey to HMAC to clear CodeQL #246
CodeQL re-flagged the SHA-256 inside sessionPoolKey at high severity even
after the rename/dedup in #2391 — its data-flow analysis still tracks the
OAuth bearer (accessToken → token) into createHash and applies the
js/insufficient-password-hash rule. Bcrypt/scrypt/argon2 would be wrong
here (the input is a high-entropy bearer, not a low-entropy human password
that needs brute-force protection).

Switch to HMAC-SHA-256 with a process-scope key generated at startup
(randomBytes(32)). HMAC is a MAC primitive, not a password hash, so the
CodeQL rule no longer applies; uniqueness, determinism-within-process,
and the 16-char hex shape all still hold, and as a small bonus an
off-process attacker can no longer precompute pool keys from a token
alone.

Tests
- Replace the "exact SHA-256 prefix" assertion with shape/uniqueness
  checks and a regression guard that fails if the implementation ever
  reverts to plain createHash.
- All 15 copilot-web tests pass.
2026-05-18 23:53:16 -03:00
..
2026-04-19 19:50:30 -03:00
2026-05-10 00:55:06 -03:00
2026-05-10 00:55:06 -03:00
2026-04-30 01:27:03 -03:00
2026-05-10 00:55:06 -03:00
2026-05-10 00:55:06 -03:00
2026-05-10 00:55:06 -03:00
2026-05-10 00:55:06 -03:00
2026-05-10 00:55:06 -03:00
2026-05-10 00:55:06 -03:00
2026-04-30 01:27:03 -03:00
2026-04-30 01:27:03 -03:00
2026-05-10 00:55:06 -03:00
2026-04-30 14:08:50 -03:00
2026-05-10 00:55:06 -03:00
2026-04-30 01:27:03 -03:00
2026-04-30 01:27:03 -03:00
2026-04-30 01:27:03 -03:00
2026-04-28 10:03:39 -03:00
2026-04-28 20:46:25 -03:00
2026-05-10 00:55:06 -03:00
2026-04-28 20:46:25 -03:00
2026-04-30 14:08:50 -03:00
2026-05-10 00:55:06 -03:00
2026-04-30 01:27:03 -03:00