mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-31 04:12:10 +03:00
b05bc7469e
* fix(compression): broaden RTK raw-output secret redaction (Basic/Proxy auth + keys)
F5.3 follow-up. SECRET_PATTERNS missed Authorization / Proxy-Authorization with
Basic (curl -v emits "Basic <base64>") and credential field names that don't
contain token/secret/password as a substring (private_key, access_key, credential).
Add a (Proxy-)Authorization Bearer|Basic pattern and broaden the key-name
alternation. All patterns are flat (no nested quantifiers → no ReDoS).
* fix(compression): drop ReDoS-prone patterns from custom RTK filters
F5.3 follow-up. Custom filters (DATA_DIR/rtk/filters.json) carry user-supplied
regex strings compiled and run against untrusted tool output; a nested unbounded
quantifier ((a+)+, (a*)*, ([a-z]+)+ …) can cause catastrophic backtracking.
validateRtkFilter now drops such patterns via a conservative, dependency-free
heuristic (isReDoSProne) applied to every regex-bearing array in the canonical and
legacy filter shapes. safe-regex would be ideal but is not installable in this
symlinked worktree; the heuristic catches the common single-group nested-quantifier
shapes and is itself linear.
Surfaced (not fixed here): a canonical pack filter omitting `preserve` crashes
validateRtkFilter because rtkFilterPreserveSchema.default({}) leaves the inner arrays
undefined — tracked as a pre-existing fragility.