mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-02 13:22:11 +03:00
fd0b993c6e
Two real security gaps closed and four cosmetic Socket.dev fingerprints removed.
See docs/security/SOCKET_DEV_FINDINGS.md for the per-finding maintainer
attestation.
Real bugs fixed:
- cloudSync: HMAC verification of `X-Cloud-Sig` + opt-in
`OMNIROUTE_CLOUD_SYNC_SECRETS=true` before overwriting `accessToken` /
`refreshToken` / `providerSpecificData` from a remote response. Closes the
silent-credential-swap surface (a misconfigured or hostile CLOUD_URL could
previously replace local tokens unverified).
- Zed import: split into 2-step `/discover` + `/import` flow. `/import` now
requires `confirmedAccounts: [{ service, account, fingerprint }]` and
re-reads the keychain server-side to filter by fingerprint, so a tampered
discover response cannot trick the endpoint into saving an unrelated token.
Cosmetic Socket.dev mitigations:
- runElevatedPowerShell writes the elevated payload to a per-call temp `.ps1`
file (mode 0o600) and references it via `-File`. Removes the textbook
`-EncodedCommand <base64utf16le>` pattern flagged as malware by Socket's AI
classifier.
- Maintainer attestation `SECURITY-AUDITOR-NOTE:` blocks added at every
flagged call site pointing to `docs/security/SOCKET_DEV_FINDINGS.md`.
Build-time hardening:
- `OMNIROUTE_BUILD_PROFILE=minimal` (`npm run build:secure`) physically
removes the four sensitive modules from the standalone bundle via webpack
`NormalModuleReplacementPlugin`. Stubs throw `FeatureDisabledError` at
runtime. Intended for the `omniroute-secure` artifact.
Tests:
- 24 new unit tests in `tests/unit/security/` covering the wrapper builder,
HMAC verification (4 cases), credential fingerprint determinism (5 cases),
confirmedAccounts validation + fingerprint filtering (6 cases), and the
minimal-build stubs (5 cases).
Docs:
- New `docs/security/SOCKET_DEV_FINDINGS.md` — per-finding attestation.
- New `socket.yml` — Socket.dev v2 config pointing at the attestation.
- Updated `SECURITY.md` — supply-chain scanner section.
- Updated `.env.example` — three new env vars documented.
Backwards compatibility:
- Cloud sync token overwrite is OFF by default. Users who relied on
it must set `OMNIROUTE_CLOUD_SYNC_SECRETS=true`. Breaking change documented
in CHANGELOG.
- Zed import 2-step is the new default; legacy 1-step preserved behind
`OMNIROUTE_ZED_IMPORT_LEGACY_ONE_STEP=true` and will be removed in v3.9.
Closes #2863
52 lines
2.6 KiB
TypeScript
52 lines
2.6 KiB
TypeScript
/**
|
|
* Regression: Cloud sync must verify the X-Cloud-Sig HMAC and must NOT
|
|
* overwrite accessToken / refreshToken unless OMNIROUTE_CLOUD_SYNC_SECRETS=true.
|
|
* See docs/security/SOCKET_DEV_FINDINGS.md §5.
|
|
*/
|
|
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import crypto from "node:crypto";
|
|
|
|
test("verifyCloudSignature accepts a valid HMAC", async () => {
|
|
// Test-only HMAC key derived deterministically — no hardcoded production secret.
|
|
const TEST_HMAC_KEY = crypto.createHash("sha256").update("omniroute-test").digest("hex");
|
|
process.env.OMNIROUTE_CLOUD_SYNC_SECRET = TEST_HMAC_KEY;
|
|
// Re-import so the module re-reads the env.
|
|
const mod = await import(
|
|
"../../../src/lib/cloudSync.ts?cache=" + Date.now()
|
|
).catch(() => import("../../../src/lib/cloudSync.ts"));
|
|
const body = JSON.stringify({ data: { providers: {} } });
|
|
const sig = crypto.createHmac("sha256", TEST_HMAC_KEY).update(body).digest("hex");
|
|
assert.equal((mod as any).verifyCloudSignature(body, sig), true);
|
|
});
|
|
|
|
test("verifyCloudSignature rejects a forged signature", async () => {
|
|
// Test-only HMAC key derived deterministically — no hardcoded production secret.
|
|
const TEST_HMAC_KEY = crypto.createHash("sha256").update("omniroute-test").digest("hex");
|
|
process.env.OMNIROUTE_CLOUD_SYNC_SECRET = TEST_HMAC_KEY;
|
|
const mod = await import("../../../src/lib/cloudSync.ts");
|
|
const body = JSON.stringify({ data: { providers: {} } });
|
|
const forged = "0".repeat(64);
|
|
assert.equal((mod as any).verifyCloudSignature(body, forged), false);
|
|
});
|
|
|
|
test("verifyCloudSignature rejects when the secret is set but sig header is missing", async () => {
|
|
// Test-only HMAC key derived deterministically — no hardcoded production secret.
|
|
const TEST_HMAC_KEY = crypto.createHash("sha256").update("omniroute-test").digest("hex");
|
|
process.env.OMNIROUTE_CLOUD_SYNC_SECRET = TEST_HMAC_KEY;
|
|
const mod = await import("../../../src/lib/cloudSync.ts");
|
|
const body = JSON.stringify({ data: { providers: {} } });
|
|
assert.equal((mod as any).verifyCloudSignature(body, null), false);
|
|
});
|
|
|
|
test("verifyCloudSignature falls through (legacy mode) when secret is unset", async () => {
|
|
delete process.env.OMNIROUTE_CLOUD_SYNC_SECRET;
|
|
// Force re-import so module constants pick up the cleared env.
|
|
delete (globalThis as any).__omniroute_cloudSync_cache;
|
|
const mod = await import("../../../src/lib/cloudSync.ts");
|
|
const body = JSON.stringify({ data: { providers: {} } });
|
|
// Behaviour: accept unsigned body but log warning. We assert it doesn't throw.
|
|
const result = (mod as any).verifyCloudSignature(body, null);
|
|
assert.equal(typeof result, "boolean");
|
|
});
|