fix(security): harden auth, SSRF, injection, and CORS across API routes#3792

Merged

waleedlatif1 merged 25 commits intostagingfrom

waleedlatif1/review-race-condition

Mar 26, 2026

Commits on Mar 26, 2026

fix: prevent auth bypass via user-controlled context query param in file serve

waleedlatif1
and
claude
committed
fix: use randomized heredoc delimiter in SSH execute-script route

waleedlatif1
and
claude
committed
fix: escape workingDirectory in SSH execute-command route

waleedlatif1
and
claude
committed
fix: harden chat/form deployment auth (OTP brute-force, CSPRNG, HMAC tokens)

waleedlatif1
and
claude
committed
fix: harden SSRF protections and input validation across API routes

waleedlatif1
and
claude
committed
lint
waleedlatif1
committed
fix(file-serve): remove user-controlled context param from authenticated path
waleedlatif1
committed
fix: handle legacy OTP format in decodeOTPValue for deploy-time compat

waleedlatif1
and
claude
committed
fix(mcp): distinguish DNS resolution failures from SSRF policy blocks

waleedlatif1
and
claude
committed
fix: make OTP attempt counting atomic to prevent TOCTOU race

waleedlatif1
and
claude
committed
fix: check attempt count before OTP comparison to prevent bypass

waleedlatif1
and
claude
committed
fix: validate OIDC discovered endpoints against SSRF

waleedlatif1
and
claude
committed
fix: remove duplicate OIDC endpoint SSRF validation block

waleedlatif1
and
claude
committed
fix: validate OIDC discovered endpoints and pin DNS for 1Password Connect

waleedlatif1
and
claude
committed
lint
waleedlatif1
committed
fix: replace KEEPTTL with TTL+EX for Redis <6.0 compat, add DB retry loop

waleedlatif1
and
claude
committed
fix: address review feedback on OTP atomicity and 1Password fetch

waleedlatif1
and
claude
committed
fix: treat Lua nil return as locked when OTP key is missing

waleedlatif1
and
claude
committed
fix: handle Lua nil as locked OTP and add SSRF check to MCP env resolution

waleedlatif1
and
claude
committed
fix: narrow resolvedIP type guard instead of non-null assertion

waleedlatif1
and
claude
committed
fix: bind auth tokens to deployment password for immediate revocation

waleedlatif1
and
claude
committed
fix: bind auth tokens to deployment password and remove resolvedIP non-null assertion

waleedlatif1
and
claude
committed
fix: update test assertions for new encryptedPassword parameter

waleedlatif1
and
claude
committed
fix: format long lines in chat/form test assertions

waleedlatif1
and
claude
committed
fix: pass encryptedPassword through OTP route cookie generation

waleedlatif1
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(security): harden auth, SSRF, injection, and CORS across API routes#3792

fix(security): harden auth, SSRF, injection, and CORS across API routes#3792
waleedlatif1 merged 25 commits intostagingfrom
waleedlatif1/review-race-condition

Commits on Mar 26, 2026

fix: prevent auth bypass via user-controlled context query param in file serve

fix: use randomized heredoc delimiter in SSH execute-script route

fix: escape workingDirectory in SSH execute-command route

fix: harden chat/form deployment auth (OTP brute-force, CSPRNG, HMAC tokens)

fix: harden SSRF protections and input validation across API routes

lint

fix(file-serve): remove user-controlled context param from authenticated path

fix: handle legacy OTP format in decodeOTPValue for deploy-time compat

fix(mcp): distinguish DNS resolution failures from SSRF policy blocks

fix: make OTP attempt counting atomic to prevent TOCTOU race

fix: check attempt count before OTP comparison to prevent bypass

fix: validate OIDC discovered endpoints against SSRF

fix: remove duplicate OIDC endpoint SSRF validation block

fix: validate OIDC discovered endpoints and pin DNS for 1Password Connect

lint

fix: replace KEEPTTL with TTL+EX for Redis <6.0 compat, add DB retry loop

fix: address review feedback on OTP atomicity and 1Password fetch

fix: treat Lua nil return as locked when OTP key is missing

fix: handle Lua nil as locked OTP and add SSRF check to MCP env resolution

fix: narrow resolvedIP type guard instead of non-null assertion

fix: bind auth tokens to deployment password for immediate revocation

fix: bind auth tokens to deployment password and remove resolvedIP non-null assertion

fix: update test assertions for new encryptedPassword parameter

fix: format long lines in chat/form test assertions

fix: pass encryptedPassword through OTP route cookie generation