mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-31 04:12:10 +03:00
fd0b993c6e
Two real security gaps closed and four cosmetic Socket.dev fingerprints removed.
See docs/security/SOCKET_DEV_FINDINGS.md for the per-finding maintainer
attestation.
Real bugs fixed:
- cloudSync: HMAC verification of `X-Cloud-Sig` + opt-in
`OMNIROUTE_CLOUD_SYNC_SECRETS=true` before overwriting `accessToken` /
`refreshToken` / `providerSpecificData` from a remote response. Closes the
silent-credential-swap surface (a misconfigured or hostile CLOUD_URL could
previously replace local tokens unverified).
- Zed import: split into 2-step `/discover` + `/import` flow. `/import` now
requires `confirmedAccounts: [{ service, account, fingerprint }]` and
re-reads the keychain server-side to filter by fingerprint, so a tampered
discover response cannot trick the endpoint into saving an unrelated token.
Cosmetic Socket.dev mitigations:
- runElevatedPowerShell writes the elevated payload to a per-call temp `.ps1`
file (mode 0o600) and references it via `-File`. Removes the textbook
`-EncodedCommand <base64utf16le>` pattern flagged as malware by Socket's AI
classifier.
- Maintainer attestation `SECURITY-AUDITOR-NOTE:` blocks added at every
flagged call site pointing to `docs/security/SOCKET_DEV_FINDINGS.md`.
Build-time hardening:
- `OMNIROUTE_BUILD_PROFILE=minimal` (`npm run build:secure`) physically
removes the four sensitive modules from the standalone bundle via webpack
`NormalModuleReplacementPlugin`. Stubs throw `FeatureDisabledError` at
runtime. Intended for the `omniroute-secure` artifact.
Tests:
- 24 new unit tests in `tests/unit/security/` covering the wrapper builder,
HMAC verification (4 cases), credential fingerprint determinism (5 cases),
confirmedAccounts validation + fingerprint filtering (6 cases), and the
minimal-build stubs (5 cases).
Docs:
- New `docs/security/SOCKET_DEV_FINDINGS.md` — per-finding attestation.
- New `socket.yml` — Socket.dev v2 config pointing at the attestation.
- Updated `SECURITY.md` — supply-chain scanner section.
- Updated `.env.example` — three new env vars documented.
Backwards compatibility:
- Cloud sync token overwrite is OFF by default. Users who relied on
it must set `OMNIROUTE_CLOUD_SYNC_SECRETS=true`. Breaking change documented
in CHANGELOG.
- Zed import 2-step is the new default; legacy 1-step preserved behind
`OMNIROUTE_ZED_IMPORT_LEGACY_ONE_STEP=true` and will be removed in v3.9.
Closes #2863
29 lines
872 B
YAML
29 lines
872 B
YAML
# Socket.dev / Socket GitHub app configuration.
|
|
# Documentation: https://docs.socket.dev/docs/socket-yml
|
|
#
|
|
# OmniRoute bundles privileged opt-in features (MITM proxy, Zed credential
|
|
# import, embedded service supervisor, Cloud Sync) inside the Next.js
|
|
# standalone build output. The v3.8.6 release applies in-tree mitigations for
|
|
# the six `gptMalware` findings raised against v3.8.5. The maintainer-signed
|
|
# attestation lives at:
|
|
#
|
|
# docs/security/SOCKET_DEV_FINDINGS.md
|
|
#
|
|
# Each flagged function carries an inline `SECURITY-AUDITOR-NOTE:` block.
|
|
version: 2
|
|
|
|
projectIgnorePaths:
|
|
# Test fixtures, scratch directories, and design documentation are not
|
|
# shipped to users.
|
|
- "tests/"
|
|
- "_tasks/"
|
|
- "_references/"
|
|
- "_ideia/"
|
|
- "_mono_repo/"
|
|
- "docs/"
|
|
- "coverage/"
|
|
- "playwright-report/"
|
|
- "test-results/"
|
|
|
|
# triggerPaths default is "*" — keep it.
|