mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-24 08:02:14 +03:00
0f4a92718c
Two findings from the automated push security review on #11205: 1. HIGH (Agent/Subprocess Permission Bypass): approvalPolicy "never" + sandbox "danger-full-access" defaults, plus blanket auto-APPROVE of every server->client approval prompt, meant codex-decided host commands ran with no gate at all. Now: sandbox defaults to "workspace-write" (override via providerSpecificData.codexAppServerSandbox / OMNIROUTE_CODEX_APPSERVER_SANDBOX), and approval prompts — which gate codex's OWN command/file/permission execution, NOT the harness tool passthrough (item/tool/call) — are auto-DENIED unless the operator opts in via providerSpecificData.codexAppServerAutoApprove / OMNIROUTE_CODEX_APPSERVER_AUTO_APPROVE. 2. MEDIUM (SSRF / credential exfiltration): the /readyz health probe sent the bearer token to whatever URL a connection's providerSpecificData supplied and followed redirects. Now: env-sourced tokens only pair with env-sourced URLs or operator-local hosts (loopback/RFC1918/link-local/ULA/localhost/ single-label LAN names/*.local/*.ts.net/*.internal — literal match, no DNS), enforced inside resolveAppServerConfig so executor, gating and health probe all inherit it; and the probe uses redirect:"manual". TDD: 4 failing-then-passing tests (deny-by-default, workspace-write default, env-token→remote-psd-URL refusal incl. no-network assertion, redirect pinning) plus 6 new passing cases (local-host matrix, psd-token pairing, env/env pairing, opt-in approve). 30/30 in tests/unit/codex-app-server.test.ts. Also rebaselines two file-size entries that drifted on the release tip during the 2026-08-23 merge wave (annotated; verified pristine-tip).