mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-01 21:02:12 +03:00
Integrates two community contributions into release/v3.8.8 with security hardening and conflict resolution. - **Plugins framework** (#2913 — thanks @oyi77): hooks + registry unification, plugin SDK (`definePlugin`), worker-thread sandbox, per-plugin hook rate limiting, SHA-256 integrity verification, semver-gated upgrade, and execution analytics. Plugin routes are loopback-only (`isLocalOnlyPath`); `child_process` exec is opt-in via `OMNIROUTE_PLUGINS_ALLOW_EXEC` (default off). - **API key option: disable non-published models** (#3017 — thanks @androw): a per-key flag restricting the key to discovered public models (combos / `auto/*` / `qtSd/*` routing still allowed). Hardening applied during integration: migration renumber (089/090/091), `/api/plugins` LOCAL_ONLY route-guard classification (closes the plugin-RCE vector), atomic install/upgrade with path containment, `O_EXCL` tmp-file creation (TOCTOU), rate-limit-map eviction, `validatePluginConfig` on configure, `buildErrorBody` on all plugin error paths. 246/246 tests; typecheck / cycles / docs-sync clean. Co-authored-by: oyi77 <14921983+oyi77@users.noreply.github.com> Co-authored-by: Nicolas Lorin <androw95220@gmail.com>
30 lines
806 B
TypeScript
30 lines
806 B
TypeScript
/**
|
|
* Plugin sandbox — configurable isolation levels.
|
|
*
|
|
* @module plugins/sandbox
|
|
*/
|
|
|
|
export enum SandboxLevel {
|
|
/** Run in-process (no isolation, fastest) */
|
|
IN_PROCESS = 0,
|
|
/** Run in child process with full environment */
|
|
CHILD_FULL_ENV = 1,
|
|
/** Run in child process with filtered environment */
|
|
CHILD_FILTERED_ENV = 2,
|
|
/** Run in child process with isolated environment (no env vars) */
|
|
CHILD_ISOLATED = 3,
|
|
}
|
|
|
|
export function getSandboxLabel(level: SandboxLevel): string {
|
|
switch (level) {
|
|
case SandboxLevel.IN_PROCESS:
|
|
return "In-Process";
|
|
case SandboxLevel.CHILD_FULL_ENV:
|
|
return "Child (Full Env)";
|
|
case SandboxLevel.CHILD_FILTERED_ENV:
|
|
return "Child (Filtered Env)";
|
|
case SandboxLevel.CHILD_ISOLATED:
|
|
return "Child (Isolated)";
|
|
}
|
|
}
|