mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-26 09:52:11 +03:00
705ab8e690
Quality Gate was failing on New Code with 1 hotspot, 1 vulnerability and 4 reliability bugs. Resolved each at the source (no SonarCloud mark-as-safe): Reliability (4 bugs → rating back to A): - usage.ts: drop duplicate `case "opencode-go"` (S1862) — the 2nd case was dead (first match wins) and would have called the wrong usage fetcher. Also de-duplicate the same id in USAGE_FETCHER_PROVIDERS (mirrors the switch; prevented a double quota-fetcher registration). - ApiManagerPageClient.tsx: a dangling `.find(...)?.timestamp || null` expression (S905) discarded the better matcher — `lastUsed` silently lost the name-fallback for legacy logs without apiKeyId. Assign the complete matcher. - chat.ts / auth.ts: `Promise` used in a boolean conditional (S6544). Both are intentional (memoized promise / mutex default), not a forgotten await — made the intent explicit via `!== null` and `??` (behaviour identical). Security (vulnerability → rating back to A): - nvidia-startswith-diag.ts: neutralize CR/LF before logging env-derived values (S5145 log injection) in the ad-hoc diagnostic script. Security Hotspot (reviewed → 0 open): - pluginWorker.ts uses `vm.runInContext` to run plugin code — that IS the worker's purpose, inside a hardened vm sandbox (createContext, require allow-list of just `crypto`, 10s timeout); not eval/new Function. Suppress S1523 scoped only to pluginWorker.ts in sonar-project.properties, with the same documented-justification pattern as the existing hotspot suppressions.
44 lines
2.6 KiB
Properties
44 lines
2.6 KiB
Properties
sonar.projectKey=diegosouzapw_OmniRoute
|
||
sonar.organization=diegosouzapw
|
||
sonar.sourceEncoding=UTF-8
|
||
sonar.sources=src,open-sse,scripts,bin,next.config.mjs,Dockerfile
|
||
sonar.tests=tests
|
||
sonar.test.inclusions=tests/**/*.test.ts,tests/**/*.spec.ts
|
||
sonar.exclusions=tests/**,src/i18n/messages/**,docs/**,coverage/**,.next/**,dist/**,build/**,node_modules/**
|
||
sonar.javascript.lcov.reportPaths=coverage/lcov.info
|
||
sonar.coverage.exclusions=**/*
|
||
sonar.cpd.exclusions=**/*
|
||
|
||
# ── Hotspot suppressions ───────────────────────────────────────────────────
|
||
# The following rules surface "review this" hotspots that are bounded /
|
||
# non-security contexts in this codebase:
|
||
# S5852 – Regex with super-linear backtracking. All matched call sites
|
||
# use bounded character classes (e.g. `[^\]]+`) — no catastrophic
|
||
# backtracking is possible.
|
||
# S2245 – pseudo-random `Math.random()`. The few remaining call sites are
|
||
# for non-security purposes (request IDs / jitter), never for
|
||
# tokens, secrets, or session material.
|
||
# S4036 – PATH lookups via `command -v` / `which`. The CLI helper resolves
|
||
# tooling on the user's own machine; running with their PATH is
|
||
# intentional and matches the behaviour of every other CLI on the
|
||
# system.
|
||
# S1523 – Dynamic code execution. SCOPED to src/lib/plugins/pluginWorker.ts
|
||
# only: running plugin source IS the worker's purpose, and it does so
|
||
# inside a hardened Node `vm` sandbox (vm.createContext, a require
|
||
# allow-list of just `crypto`, and a 10s execution timeout). Not
|
||
# `eval`/`new Function` (Hard Rule #3). S1523 stays active everywhere
|
||
# else so a genuine dynamic-exec elsewhere is still flagged.
|
||
sonar.issue.ignore.multicriteria=h1,h2,h3,h4,h5,h6
|
||
sonar.issue.ignore.multicriteria.h1.ruleKey=javascript:S5852
|
||
sonar.issue.ignore.multicriteria.h1.resourceKey=**/*
|
||
sonar.issue.ignore.multicriteria.h2.ruleKey=typescript:S5852
|
||
sonar.issue.ignore.multicriteria.h2.resourceKey=**/*
|
||
sonar.issue.ignore.multicriteria.h3.ruleKey=typescript:S2245
|
||
sonar.issue.ignore.multicriteria.h3.resourceKey=**/*
|
||
sonar.issue.ignore.multicriteria.h4.ruleKey=javascript:S4036
|
||
sonar.issue.ignore.multicriteria.h4.resourceKey=**/*
|
||
sonar.issue.ignore.multicriteria.h5.ruleKey=typescript:S4036
|
||
sonar.issue.ignore.multicriteria.h5.resourceKey=**/*
|
||
sonar.issue.ignore.multicriteria.h6.ruleKey=typescript:S1523
|
||
sonar.issue.ignore.multicriteria.h6.resourceKey=**/pluginWorker.ts
|