Release 20251015 #22
Release 20251015 #22
Conversation
Fix sdk mtls testing logic
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| const mtlsBaseUrl = forcePort444 && !baseUrl.includes(':444') | ||
| ? (baseUrl.includes(':444') | ||
| ? baseUrl.replace(':444', ':444') |
Check warning
Code scanning / CodeQL
Replacement of a substring with itself Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 28 days ago
The fix is to remove the redundant replace operation and simply return baseUrl in this else-branch.
Specifically, in createACubeMTLSConfig, lines 93–97 build the mtlsBaseUrl.
- Remove the unnecessary
baseUrl.replace(':444', ':444')call (line 95). - Let the branch simply refer to
baseUrlwhen':444'is already present. - No further imports or helper methods are necessary.
Only this region in the filesrc/core/adapter-loader.tsneeds to change.
| @@ -92,7 +92,7 @@ | ||
|
|
||
| const mtlsBaseUrl = forcePort444 && !baseUrl.includes(':444') | ||
| ? (baseUrl.includes(':444') | ||
| ? baseUrl.replace(':444', ':444') | ||
| ? baseUrl | ||
| : baseUrl.replace(/:\d+$/, '') + ':444') | ||
| : baseUrl; | ||
|
|
|
|
||
| // Generate temporary receipt data for UI | ||
| const tempReceipt: ReceiptOutput = { | ||
| uuid: operationId, |
Check failure
Code scanning / CodeQL
Insecure randomness High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 28 days ago
To fix the insecure randomness, update the ID generation logic in OperationQueue.generateId() (in src/offline/queue.ts) to use a cryptographically secure random generator. For browser context, use window.crypto.getRandomValues; for Node context, use require('crypto').randomUUID(). Given the presence of .substr(2, 9) (implying legacy support), but if unique string IDs are desired, use a securely generated UUID or a securely generated random string. Also, add any required imports (import { randomUUID } from 'crypto'; for Node.js).
Steps:
- In
src/offline/queue.ts, replace the use ofMath.random()ingenerateId()with a call torandomUUID()(if Node.js >= v14.17, recommended) or a securely generated random value. - If using
randomUUID(), prepend the timestamp as currently done, or use only the UUID if timestamp isn't strictly needed or can be sanitized. - Add required imports if not already present.
No other files require modification for this fix.
| @@ -1,4 +1,5 @@ | ||
| import { IStorage } from '../adapters'; | ||
| import { randomUUID } from 'crypto'; | ||
| import { | ||
| QueuedOperation, | ||
| OperationType, | ||
| @@ -296,7 +297,8 @@ | ||
| * Generate unique ID for operations | ||
| */ | ||
| private generateId(): string { | ||
| return `${Date.now()}-${Math.random().toString(36).substr(2, 9)}`; | ||
| // Use a cryptographically secure random UUID as the operation ID (with timestamp as prefix for legacy reasons) | ||
| return `${Date.now()}-${randomUUID()}`; | ||
| } | ||
|
|
||
| /** |
No description provided.