Files
OmniRoute/tests/unit
Diego Rodrigues de Sa e Souza 85c4292ce3 fix(security): correct XML double-unescape and non-CSPRNG nonce from CodeQL sweep (#10154)
* fix(security): correct XML double-unescape and non-CSPRNG nonce from CodeQL sweep

Two real defects surfaced by the 2026-08-12 code-scanning triage.

decodeXmlText decoded `&` before `"`/`'`, so `"` — the encoding of
the literal text `"` — collapsed to `"` in a second pass. The decoded values feed the
workspace-root trust comparison in parseTrustedCodexEnvironment, so an encoded path could
decode into a different path than the client declared. Decoding `&` last fixes it.

The tinycms nonce fell back to `Date.now()` plus a non-cryptographic PRNG when
`crypto.randomUUID` was absent. That nonce is signed into the provider's anti-replay
payload, so the fallback produced a predictable value silently. It is now always
`randomUUID()` from node:crypto, which is present on every supported runtime.

Both guards are mutation-validated: reverting either fix makes the new test fail.

Refs #9985

* fix(security): reword tinycms nonce comment so the CSPRNG regression test holds

---------

Co-authored-by: backryun <bakryun0718@proton.me>
2026-08-12 16:03:58 -03:00
..
2026-07-02 10:47:13 -03:00
2026-06-30 06:54:29 -03:00
2026-06-17 19:26:32 -03:00
2026-07-29 15:18:55 -03:00
2026-06-09 22:57:12 -03:00
2026-06-30 06:54:29 -03:00
2026-06-29 08:40:06 -03:00
2026-07-02 10:47:13 -03:00
2026-06-25 13:17:40 -03:00
2026-06-29 16:51:03 -03:00
2026-07-29 15:18:55 -03:00
2026-06-28 06:58:29 -03:00
2026-06-27 09:07:12 -03:00
2026-07-29 15:18:55 -03:00
2026-05-29 12:44:29 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-06-23 17:06:18 -03:00
2026-06-13 17:27:40 -03:00
2026-07-13 09:12:40 -03:00
2026-07-13 09:12:40 -03:00
2026-07-04 13:00:30 -03:00
2026-07-02 10:47:13 -03:00
2026-05-29 12:44:29 -03:00
2026-06-29 16:51:03 -03:00
2026-05-29 12:44:29 -03:00
2026-06-27 09:07:12 -03:00
2026-07-29 15:18:55 -03:00
2026-05-24 18:05:58 -03:00
2026-06-17 19:26:32 -03:00
2026-05-26 23:51:47 -03:00
2026-07-13 09:12:40 -03:00
2026-07-13 09:12:40 -03:00
2026-06-29 08:40:06 -03:00
2026-07-13 09:12:40 -03:00
2026-06-13 17:27:40 -03:00
2026-06-16 01:00:40 -03:00
2026-07-07 13:14:06 -03:00
2026-06-29 08:40:06 -03:00
2026-06-21 08:56:51 -03:00
2026-05-26 23:51:47 -03:00
2026-06-21 08:56:51 -03:00
2026-06-23 03:08:29 -03:00
2026-05-29 12:44:29 -03:00
2026-06-29 08:40:06 -03:00
2026-05-26 23:51:47 -03:00
2026-07-13 09:12:40 -03:00
2026-05-26 23:51:47 -03:00
2026-05-29 12:44:29 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-05-10 00:55:06 -03:00
2026-05-26 23:51:47 -03:00
2026-06-13 17:27:40 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-06-29 16:51:03 -03:00
2026-04-30 01:27:03 -03:00
2026-04-30 01:27:03 -03:00
2026-07-07 13:14:06 -03:00
2026-07-29 15:18:55 -03:00
2026-06-23 17:06:18 -03:00
2026-07-29 15:18:55 -03:00
2026-07-04 13:00:30 -03:00
2026-07-04 13:00:30 -03:00
2026-06-26 02:51:06 -03:00
2026-07-29 15:18:55 -03:00
2026-07-07 13:14:06 -03:00
2026-06-29 16:51:03 -03:00
2026-05-26 23:51:47 -03:00
2026-04-30 14:08:50 -03:00
2026-06-29 16:51:03 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-06-17 02:43:21 -03:00
2026-05-26 23:51:47 -03:00
2026-07-06 02:25:17 -03:00
2026-06-15 03:32:11 -03:00
2026-07-29 15:18:55 -03:00
2026-05-26 23:51:47 -03:00
2026-07-13 09:12:40 -03:00
2026-07-07 13:14:06 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-07 13:14:06 -03:00
2026-07-07 13:14:06 -03:00
2026-07-29 15:18:55 -03:00
2026-06-20 14:55:24 -03:00
2026-06-22 03:17:02 -03:00
2026-07-13 09:12:40 -03:00
2026-07-04 13:00:30 -03:00
2026-06-26 02:51:06 -03:00
2026-07-04 13:00:30 -03:00
2026-06-27 09:07:12 -03:00
2026-06-19 06:49:01 -03:00
2026-06-20 07:09:43 -03:00
2026-07-07 13:14:06 -03:00
2026-07-07 13:14:06 -03:00
2026-04-30 01:27:03 -03:00
2026-06-22 03:17:02 -03:00
2026-07-29 15:18:55 -03:00
2026-07-07 13:14:06 -03:00
2026-07-07 13:14:06 -03:00
2026-06-19 06:49:01 -03:00
2026-06-12 23:49:22 -03:00
2026-06-12 23:49:22 -03:00
2026-06-11 18:52:29 -03:00
2026-06-29 08:40:06 -03:00
2026-06-30 06:54:29 -03:00
2026-07-04 13:00:30 -03:00
2026-07-29 15:18:55 -03:00
2026-06-30 06:54:29 -03:00
2026-06-29 16:51:03 -03:00
2026-07-04 13:00:30 -03:00
2026-07-29 15:18:55 -03:00
2026-06-29 08:40:06 -03:00
2026-07-07 13:14:06 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-05-23 01:46:59 -03:00
2026-05-23 01:46:59 -03:00
2026-06-09 15:56:24 -03:00
2026-07-29 15:18:55 -03:00
2026-05-29 19:54:00 -03:00
2026-06-29 08:40:06 -03:00
2026-07-07 13:14:06 -03:00
2026-06-17 19:26:32 -03:00
2026-06-13 17:27:40 -03:00
2026-07-07 13:14:06 -03:00
2026-07-29 15:18:55 -03:00
2026-06-30 06:54:29 -03:00
2026-07-04 13:00:30 -03:00
2026-07-29 15:18:55 -03:00
2026-05-24 18:05:58 -03:00
2026-06-30 06:54:29 -03:00
2026-06-29 08:40:06 -03:00
2026-07-29 15:18:55 -03:00
2026-04-28 20:46:25 -03:00
2026-07-29 15:18:55 -03:00
2026-07-13 09:12:40 -03:00
2026-07-13 09:12:40 -03:00
2026-07-29 15:18:55 -03:00
2026-05-29 12:44:29 -03:00
2026-06-29 16:51:03 -03:00
2026-06-23 03:08:29 -03:00
2026-05-26 23:51:47 -03:00
2026-06-30 06:54:29 -03:00
2026-06-12 23:49:22 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-06-16 01:00:40 -03:00
2026-05-26 23:51:47 -03:00
2026-06-04 20:05:38 -03:00
2026-06-12 23:49:22 -03:00
2026-07-07 13:14:06 -03:00
2026-06-29 16:51:03 -03:00
2026-06-29 08:40:06 -03:00
2026-05-29 12:44:29 -03:00
2026-07-07 13:14:06 -03:00
2026-06-20 07:09:43 -03:00
2026-06-19 06:49:01 -03:00
2026-07-29 15:18:55 -03:00
2026-06-11 04:01:24 -03:00
2026-06-29 08:40:06 -03:00
2026-05-24 18:05:58 -03:00
2026-05-26 23:51:47 -03:00
2026-06-12 23:49:22 -03:00
2026-06-16 01:00:40 -03:00
2026-06-12 23:49:22 -03:00
2026-06-27 09:07:12 -03:00
2026-07-29 15:18:55 -03:00
2026-07-07 13:14:06 -03:00
2026-07-04 13:00:30 -03:00
2026-07-04 13:00:30 -03:00
2026-06-16 01:00:40 -03:00
2026-07-07 13:14:06 -03:00