chore(stack): synchronize session revocation with security base - #417
Closed
seonghobae wants to merge 23 commits into
Closed
chore(stack): synchronize session revocation with security base#417seonghobae wants to merge 23 commits into
seonghobae wants to merge 23 commits into
Conversation
… whitespace bypass - Bump @hono/node-server 1.19.14 → ^2.0.12 (GHSA-frvp-7c67-39w9 path traversal) - Bump hono 4.12.27 → ^4.12.32 (current patched line) - Audit CSV export: treat leading-whitespace formula prefixes as injection (align server with client CSV_FORMULA_PREFIX_PATTERN /^\s*[=+\-@|]/) - Smoke test plants a whitespace-prefixed DDE payload and asserts neutralization npm audit --omit=dev: 0 vulnerabilities. test:unit + test:api pass.
- server/auth.mjs: refuse startup when SCOPEWEAVE_JWT_SECRET is missing, <32 non-whitespace chars, or an unexpanded compose literal (no more hardcoded dev-insecure-secret fallback) - docker-compose.yml / Dockerfile.server: drop insecure default secret - cloud-sync parseMsProjectXml: replace dynamic RegExp tag parse with indexOf/slice (eliminates ReDoS / Semgrep non-literal-regexp surface) - Add tests/api/auth-secret.test.mjs; wire into test:api; strengthen MS Project unit case for regex-metachar task names - Docs (README, deploy, CLAUDE): required secret contract Supersedes open PR #329 with a clean develop rebase of the same contract.
OpenCode coverage-evidence failed: dual package-lock.json + pnpm-lock.yaml with no exact packageManager pin caused the sandbox to select the pnpm runner and refuse install. ScopeWeave is npm-canonical (Dockerfile.server npm ci, README npm scripts). Remove the vestigial pnpm-lock so coverage uses npm and the review gate can re-run.
- CLAUDE/README/deploy: document persistent JWT secret (do not re-mint each boot) - parseMsProjectXml: linear Task/PredecessorLink collection (no lazy regex) - auth-secret tests: long unexpanded compose placeholder + active env mapping assert - msproject unit: incomplete-open-tag scan stays sub-second Resolves the 4 unresolved review threads that disabled auto-merge on #386.
- Coerce non-string password inputs before scryptSync so object/array JSON bodies cannot TypeError-crash auth (folds #394 Sentinel finding). - Reject non-string passwords at signup/change-password API boundary. - Decouple npm run coverage from Playwright fuzz so OpenCode coverage- evidence can prove unit/API Istanbul without browser install. - Unit regression for hashPassword/verifyPassword type-safety paths.
* fix(ux): warn on tab close when inline editor draft is dirty
Extract editorHasUnsavedChanges() shared by Escape/close confirm and a
beforeunload handler so buyers do not lose WBS edits on refresh/close.
E2E covers Escape discard confirm and beforeunload on dirty draft.
* test(e2e): wait for beforeunload dialog event (no fixed sleep)
Address CodeRabbit flake risk: use page.waitForEvent('dialog') instead
of waitForTimeout after dirty-editor navigation.
- verifyPassword returns false for non-string inputs so object/array JSON bodies cannot match an empty-password hash (CodeRabbit major). - Login/change-password/delete-account require typeof password === 'string'. - CLAUDE.md cloud Node range matches engines (^22.13.0 || >=23.4.0). - Unit tests assert non-strings never verify empty-password hashes.
Strix "Run Strix (quick)" stayed in_progress >18m on 644e9fc while merge-scheduler blocked on same-head Strix evidence. Empty commit refreshes the PR head so concurrency can cancel the stuck run and re-emit Strix + OpenCode path for auto-merge.
OpenCode dispatch failed on eca8874: app.js and static_coverage_evidence.mjs missing from coverage-final.json; server/app.mjs changed branches 14/15. - c8 includes app.js + scripts/ci/static_coverage_evidence.mjs - editor-unsaved unit harness (vm + absolute filename) covers dirty-draft helper, beforeunload, and closeEditor confirm paths - static_coverage_evidence tests cover docstrings + invalid-mode exit - API smoke: non-string password boundaries on signup/login/change/delete - Wire both into test:unit and test:coverage npm run coverage + test:unit + test:api pass locally.
Strix "Run Strix (quick)" stayed in_progress >15m on 4a0f118 (prior success ~9.5m). Cancel API left the run stuck in_progress; empty commit refreshes the PR head so concurrency can cancel the hung scan and re-emit Strix + OpenCode path for auto-merge.
Strix "Run Strix (quick)" stayed in_progress >13m on 658332e (prior healthy success ~9.5–10m). Cancel API may leave the run stuck; empty commit refreshes the PR head so concurrency can cancel the hung scan and re-emit Strix + OpenCode path for auto-merge.
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closed without merge. The two security branches diverged from the same
developbase and require #386 to land first rather than introducing an internal merge PR with a broad duplicate diff. #414 is being held until the verified security base is present ondevelop.