fix(security): harden auth, SSRF, injection, and CORS across API routes - #3792

Merged

waleedlatif1 merged 25 commits into

stagingfrom

waleedlatif1/review-race-condition

Mar 26, 2026

Commits on Mar 26, 2026

fix: prevent auth bypass via user-controlled context query param in file serve
waleedlatif1
and
claude
committed
6f43fc9
fix: use randomized heredoc delimiter in SSH execute-script route
waleedlatif1
and
claude
committed
be41fbc
fix: escape workingDirectory in SSH execute-command route
waleedlatif1
and
claude
committed
86d7a20
fix: harden chat/form deployment auth (OTP brute-force, CSPRNG, HMAC tokens)
waleedlatif1
and
claude
committed
331e9fc
fix: harden SSRF protections and input validation across API routes
waleedlatif1
and
claude
committed
dac7dda
lint
waleedlatif1
committed
c5ecc19
fix(file-serve): remove user-controlled context param from authenticated path
waleedlatif1
committed
35bc843
fix: handle legacy OTP format in decodeOTPValue for deploy-time compat
waleedlatif1
and
claude
committed
dea9fbe
fix(mcp): distinguish DNS resolution failures from SSRF policy blocks
waleedlatif1
and
claude
committed
7e56894
fix: make OTP attempt counting atomic to prevent TOCTOU race
waleedlatif1
and
claude
committed
16072b5
fix: check attempt count before OTP comparison to prevent bypass
waleedlatif1
and
claude
committed
44b8aba
fix: validate OIDC discovered endpoints against SSRF
waleedlatif1
and
claude
committed
bf81938
fix: remove duplicate OIDC endpoint SSRF validation block
waleedlatif1
and
claude
committed
002748f
fix: validate OIDC discovered endpoints and pin DNS for 1Password Connect
waleedlatif1
and
claude
committed
5493234
lint
waleedlatif1
committed
994e711
fix: replace KEEPTTL with TTL+EX for Redis <6.0 compat, add DB retry loop
waleedlatif1
and
claude
committed
971888d
fix: address review feedback on OTP atomicity and 1Password fetch
waleedlatif1
and
claude
committed
2f85b31
fix: treat Lua nil return as locked when OTP key is missing
waleedlatif1
and
claude
committed
1313265
fix: handle Lua nil as locked OTP and add SSRF check to MCP env resolution
waleedlatif1
and
claude
committed
f1fd878
fix: narrow resolvedIP type guard instead of non-null assertion
waleedlatif1
and
claude
committed
1cc6ed4
fix: bind auth tokens to deployment password for immediate revocation
waleedlatif1
and
claude
committed
3db061b
fix: bind auth tokens to deployment password and remove resolvedIP non-null assertion
waleedlatif1
and
claude
committed
78c0454
fix: update test assertions for new encryptedPassword parameter
waleedlatif1
and
claude
committed
b7bc591
fix: format long lines in chat/form test assertions
waleedlatif1
and
claude
committed
4790853
fix: pass encryptedPassword through OTP route cookie generation
waleedlatif1
and
claude
committed
33e6576

Navigation Menu

Uh oh!

fix(security): harden auth, SSRF, injection, and CORS across API routes - #3792

fix(security): harden auth, SSRF, injection, and CORS across API routes#3792
waleedlatif1 merged 25 commits into
stagingfrom
waleedlatif1/review-race-condition

Commits on Mar 26, 2026

fix: prevent auth bypass via user-controlled context query param in file serve

fix: use randomized heredoc delimiter in SSH execute-script route

fix: escape workingDirectory in SSH execute-command route

fix: harden chat/form deployment auth (OTP brute-force, CSPRNG, HMAC tokens)

fix: harden SSRF protections and input validation across API routes

lint

fix(file-serve): remove user-controlled context param from authenticated path

fix: handle legacy OTP format in decodeOTPValue for deploy-time compat

fix(mcp): distinguish DNS resolution failures from SSRF policy blocks

fix: make OTP attempt counting atomic to prevent TOCTOU race

fix: check attempt count before OTP comparison to prevent bypass

fix: validate OIDC discovered endpoints against SSRF

fix: remove duplicate OIDC endpoint SSRF validation block

fix: validate OIDC discovered endpoints and pin DNS for 1Password Connect

lint

fix: replace KEEPTTL with TTL+EX for Redis <6.0 compat, add DB retry loop

fix: address review feedback on OTP atomicity and 1Password fetch

fix: treat Lua nil return as locked when OTP key is missing

fix: handle Lua nil as locked OTP and add SSRF check to MCP env resolution

fix: narrow resolvedIP type guard instead of non-null assertion

fix: bind auth tokens to deployment password for immediate revocation

fix: bind auth tokens to deployment password and remove resolvedIP non-null assertion

fix: update test assertions for new encryptedPassword parameter

fix: format long lines in chat/form test assertions

fix: pass encryptedPassword through OTP route cookie generation