mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-01 12:52:11 +03:00
c04a7af39a
- Fix SSRF (CodeQL #73): sync-models route uses localhost allowlist instead of user-provided request.url to construct internal fetch target - Fix insecure randomness (CodeQL #33,#34): already fixed in geminiHelper.ts using crypto.randomBytes, stale alerts will close on rescan - Fix incomplete URL sanitization (CodeQL #109,#110): already fixed with startsWith in previous commit, stale alerts will close on rescan - Fix incomplete hostname regexp (CodeQL #103-108): already fixed with escaped dots in previous commit, stale alerts will close on rescan - Fix Dependabot #50-55: override hono@4.12.12 and @hono/node-server@1.19.13 to patch cookie bypass, IP restriction, path traversal, and serveStatic middleware bypass vulnerabilities - Fix CI: update context-manager test expectation from 1000000 to 1048576 to match registry defaultContextLength for gemini - Fix CI: sync-models route now correctly resolves localhost origin from incoming request for test compatibility