Repository navigation

fix(security): harden auth, SSRF, injection, and CORS across API routes - #3792

Merged

waleedlatif1 merged 25 commits into

stagingfrom

waleedlatif1/review-race-condition

Mar 26, 2026

Merged

fix(security): harden auth, SSRF, injection, and CORS across API routes#3792
waleedlatif1 merged 25 commits into
stagingfrom
waleedlatif1/review-race-condition

Commits on Mar 26, 2026
- fix: prevent auth bypass via user-controlled context query param in file serve
  
  waleedlatif1
  and
  claude
  committed
  6f43fc9
- fix: use randomized heredoc delimiter in SSH execute-script route
  
  waleedlatif1
  and
  claude
  committed
  be41fbc
- fix: escape workingDirectory in SSH execute-command route
  
  waleedlatif1
  and
  claude
  committed
  86d7a20
- fix: harden chat/form deployment auth (OTP brute-force, CSPRNG, HMAC tokens)
  
  waleedlatif1
  and
  claude
  committed
  331e9fc
- fix: harden SSRF protections and input validation across API routes
  
  waleedlatif1
  and
  claude
  committed
  dac7dda
- lint
  waleedlatif1
  committed
  c5ecc19
- fix(file-serve): remove user-controlled context param from authenticated path
  waleedlatif1
  committed
  35bc843
- fix: handle legacy OTP format in decodeOTPValue for deploy-time compat
  
  waleedlatif1
  and
  claude
  committed
  dea9fbe
- fix(mcp): distinguish DNS resolution failures from SSRF policy blocks
  
  waleedlatif1
  and
  claude
  committed
  7e56894
- fix: make OTP attempt counting atomic to prevent TOCTOU race
  
  waleedlatif1
  and
  claude
  committed
  16072b5
- fix: check attempt count before OTP comparison to prevent bypass
  
  waleedlatif1
  and
  claude
  committed
  44b8aba
- fix: validate OIDC discovered endpoints against SSRF
  
  waleedlatif1
  and
  claude
  committed
  bf81938
- fix: remove duplicate OIDC endpoint SSRF validation block
  
  waleedlatif1
  and
  claude
  committed
  002748f
- fix: validate OIDC discovered endpoints and pin DNS for 1Password Connect
  
  waleedlatif1
  and
  claude
  committed
  5493234
- lint
  waleedlatif1
  committed
  994e711
- fix: replace KEEPTTL with TTL+EX for Redis <6.0 compat, add DB retry loop
  
  waleedlatif1
  and
  claude
  committed
  971888d
- fix: address review feedback on OTP atomicity and 1Password fetch
  
  waleedlatif1
  and
  claude
  committed
  2f85b31
- fix: treat Lua nil return as locked when OTP key is missing
  
  waleedlatif1
  and
  claude
  committed
  1313265
- fix: handle Lua nil as locked OTP and add SSRF check to MCP env resolution
  
  waleedlatif1
  and
  claude
  committed
  f1fd878
- fix: narrow resolvedIP type guard instead of non-null assertion
  
  waleedlatif1
  and
  claude
  committed
  1cc6ed4
- fix: bind auth tokens to deployment password for immediate revocation
  
  waleedlatif1
  and
  claude
  committed
  3db061b
- fix: bind auth tokens to deployment password and remove resolvedIP non-null assertion
  
  waleedlatif1
  and
  claude
  committed
  78c0454
- fix: update test assertions for new encryptedPassword parameter
  
  waleedlatif1
  and
  claude
  committed
  b7bc591
- fix: format long lines in chat/form test assertions
  
  waleedlatif1
  and
  claude
  committed
  4790853
- fix: pass encryptedPassword through OTP route cookie generation
  
  waleedlatif1
  and
  claude
  committed
  33e6576

Commits

Commits on Mar 26, 2026