Files
OmniRoute/tests/unit
Xiangzhe b654b73e00 fix(security): don't auto-adopt an unverified listener on a service port
decidePreSpawn adopted any listener that returned a 2xx on the health path, so a
local process that squats an embedded-service port before the supervisor starts
it would be adopted — receiving the injected service API key and script execution
inside the dashboard origin. Adoption is now opt-in
(OMNIROUTE_ADOPT_EXISTING_SERVICE=1); by default a healthy-but-unverified listener
yields the same actionable error as a held-but-unhealthy port. The embedded-UI CSP
hardening (strict embed CSP / the dead scriptSrc ternary) is a separate follow-up.

Reported by @rafaelfiguereod-stack via GHSA-wg9p-6m2g-4v27.
2026-08-21 14:10:31 -03:00
..
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00