fix: comprehensive security & correctness remediation from 20-domain audit
5 months ago
Authored
mweinbachPhase 1 — Security (11 CRITICALs fixed):
- fix(xss): escape OAuth failure HTML message param (oauth-server.ts)
- fix(xss): apply escapeHtml/escapeMarkdownUrl to citation markers
- fix(xss): switch DOMPurify FORBID_ATTR to ALLOWED_ATTR allowlist
- fix(security): remove yolo:true hardcode in buildFallbackWorkspace & normalizeState
- fix(security): validate approval/ask responses via Zod in transportAdapter
- fix(security): set maxPayloadLength 4MB on WebSocket server
- fix(security): validate config paths stay inside workspace via isPathInside
- fix(security): sanitize ANSI escape sequences in CLI terminal output
- fix(security): isolate session tokens into per-device Secure Store keys
- fix(security): zero sharedKey Uint8Array before nulling in resetSecureChannel
Phase 2 — Correctness (10 items fixed, 1 false positive):
- fix(agent): replace micro-tick stream settlement with direct await + timeout
- fix(runtime): codexPayloadThreadId -> codexPayloadTurnId in usage handler
- fix(tools): add .catch(reject) to bash.ts promise chain
- fix(runtime): fix operator precedence in error message fallback
- fix(runtime): always resolve finalResult promise in openaiEventStream.end()
- fix(cli): use nextSocket instead of stale socket ref in onServerRequest
- fix(cli): add .catch on microtask line buffer promise
- fix(cli): reset disconnectNotified at start of connectToServer
- fix(client): wrap enqueueNotification throw in notify() with try/catch
- fix(mobile): remove scaffold assistant response from submitComposer
- fix(mobile): replace Date.now() thread IDs with crypto.randomUUID()
- fix(mobile): add console.warn in jsonRpcClient silent catch blocks
Tests: 26+ new tests added (terminal sanitizer, path traversal, config)
Audit: 20 parallel subagents audited 250+ files across 20 domains
Parent4967616
136 files changed
- apps/desktop/electron/ipc.ts+6−1
- apps/desktop/electron/ipc/files.ts+3−1
- apps/desktop/electron/main.ts+68−49
- apps/desktop/electron/services/persistence.ts+1−1
- apps/desktop/src/app/store.actions/bootstrap.ts+2−2
- apps/desktop/src/app/store.actions/workspaceDefaults.ts+6−4
- apps/desktop/src/app/store.helpers.ts+1−1
- apps/desktop/src/app/store.helpers/controlSocket.ts
+1
−1
apps/desktop/src/app/store.helpers/jsonRpcSocket.ts+0−1apps/desktop/src/app/store.helpers/threadEventReducer.ts+1−3apps/desktop/src/app/store.ts+40−0apps/desktop/src/components/ui/checkbox.tsx+4−3apps/desktop/src/lib/desktopSchemas.ts+1−1apps/desktop/src/lib/filePreviewKind.ts+3−1apps/desktop/src/ui/Canvas.tsx+1−5apps/desktop/src/ui/ChatView.tsx+104−66apps/desktop/src/ui/FilePreviewModal.tsx+23−7apps/desktop/src/ui/PptxPreview.tsx+10−9apps/desktop/src/ui/SlidePreview.tsx+7−6apps/desktop/src/ui/menuBar/MenuBarUtilityShell.tsx+6−6apps/desktop/src/ui/onboarding/DesktopOnboarding.tsx+9−1apps/desktop/src/ui/quickChat/QuickChatShell.tsx+3−3apps/desktop/src/ui/settings/pages/BackupPage.tsx+3−7apps/desktop/src/ui/settings/pages/RemoteAccessPage.tsx+1−1apps/desktop/src/ui/settings/pages/UsagePage.tsx+2−2apps/desktop/src/ui/settings/pages/WorkspacesPage.tsx+3−8apps/desktop/test/desktop-schemas.test.ts+2−2apps/desktop/test/file-preview-modal.test.tsx+1−1apps/desktop/test/filePreviewKind.test.ts+0−1apps/desktop/test/helpers/mockElectron.ts+17−0apps/desktop/test/ipc-files.test.ts+110−1apps/desktop/test/jsdomHarness.ts+19−0apps/desktop/test/message-bar-resizer.test.tsx+18−10apps/desktop/test/persistence-state-sanitization.test.ts+42−0apps/desktop/test/providers-page.test.ts+21−12apps/desktop/test/server-manager.test.ts+0−1apps/desktop/test/spreadsheet-preview.test.tsx+20−10apps/desktop/test/workspace-settings-sync.test.ts+30−3apps/desktop/test/workspace-startup.test.ts+1−1apps/mobile/app.json+1−8apps/mobile/bun.lock+98−15apps/mobile/metro.config.js+7−1apps/mobile/modules/cowork-pinned-https/android/build.gradle+15−0apps/mobile/modules/cowork-pinned-https/android/src/main/AndroidManifest.xml+2−0apps/mobile/modules/remodex-secure-transport/src/index.ts+4−1apps/mobile/package.json+11−1apps/mobile/postcss.config.mjs+5−0apps/mobile/src/app/(app)/thread/[id].tsx+36−2apps/mobile/src/app/_layout.tsx+2−0apps/mobile/src/components/ui/app-button.tsx+15−35apps/mobile/src/components/ui/screen.tsx+9−13apps/mobile/src/components/ui/section-card.tsx+9−43apps/mobile/src/features/cowork/backupStore.ts+3−0apps/mobile/src/features/cowork/jsonRpcClient.ts+8−4apps/mobile/src/features/cowork/mcpStore.ts+4−0apps/mobile/src/features/cowork/memoryStore.ts+2−0apps/mobile/src/features/cowork/offlineCache.ts+147−0apps/mobile/src/features/cowork/providerStore.ts+6−1apps/mobile/src/features/cowork/skillsStore.ts+8−0apps/mobile/src/features/cowork/snapshotReducer.ts+4−1apps/mobile/src/features/cowork/threadStore.ts+196−21apps/mobile/src/features/cowork/useWorkspaceConfigQuery.ts+233−0apps/mobile/src/features/cowork/workspaceBootstrap.ts+15−3apps/mobile/src/features/cowork/workspaceStore.ts+14−1apps/mobile/src/features/relay/secureTransportClient.ts+33−4apps/mobile/src/global.css+195−0apps/mobile/src/providers/MobileAppProvider.tsx+12−6apps/mobile/src/tw/animated.tsx+7−0apps/mobile/src/tw/image.tsx+31−0apps/mobile/src/tw/index.tsx+99−0src/agent.ts+49−37src/auth/oauth-server.ts+10−1src/cli/args.ts+17−0src/cli/parser.ts+8−2src/cli/repl.ts+6−1src/cli/repl/authPrompts.ts+34−2src/cli/repl/commandRouter.ts+15−12src/cli/repl/promptController.ts+8−5src/cli/repl/sanitizeTerminal.ts+44−0src/cli/repl/serverEventHandler.ts+13−6src/cli/repl/stateStore.ts+3−2src/client/jsonRpcSocket.ts+6−2src/config.ts+9−2src/connect.ts+9−1src/index.ts+6−1src/mcp/index.ts+96−0src/models/registry.ts+1−1src/observability/otel.ts+8−5src/observability/runtime.ts+4−0src/providers/codexAppServerAuth.ts+41−20src/runtime/codexAppServerRuntime.ts+211−101src/runtime/openaiEventStream.ts+1−3src/runtime/openaiResponsesProjector.ts+1−1src/server/index.ts+7−2src/server/jsonrpc/routes/session.ts+110−44src/server/jsonrpc/routes/workspace.ts+1−2src/server/jsonrpc/routes/workspaceBackups.ts+83−35src/server/jsonrpc/schema.workspace.ts+0−1src/server/jsonrpc/threadReadProjector.ts+0−4src/server/jsonrpc/transportAdapter.ts+48−12src/server/presentationPreview.ts+12−9src/server/projection/conversationProjection.ts+0−2src/server/runtime/ServerRuntime.ts+6−0src/server/session/AgentSession.ts+14−0src/server/session/McpManager.ts+4−0src/server/session/TurnExecutionManager.ts+1−0src/server/session/mcp/McpAuthFlow.ts+7−0src/server/startServer.ts+1−0src/server/webDesktopService.ts+2−2src/session/pricing.ts+13−0src/shared/displayCitationMarkers.ts+10−2src/shared/googleThinking.ts+5−1src/shared/projectedItems.ts+1−3src/tools/bash.ts+2−2test/a2ui/upsertFeedItem.test.ts+5−2test/agent.test.ts+4−2test/bun-test-setup.ts+30−0test/cli-args.test.ts+42−0test/cli-entrypoint.test.ts+54−0test/cli-sanitize-terminal.test.ts+84−0test/config.test.ts+83−6test/connect.test.ts+5−1test/helpers/mock-react-native.ts+35−0test/jsonrpc.workspace-route.test.ts+0−1test/mcp.cache.test.ts+159−0test/mobile.thread-detail.test.tsx+249−0test/mobile.thread-store.test.ts+208−43test/mobileOfflineCache.test.ts+47−0test/observability.otel.test.ts+55−1test/presentationPreview.test.ts+8−5test/providers/codex-app-server-auth.test.ts+47−0test/repl.restart-failure.test.ts+2−0test/repl.test.ts+130−0test/session.test.ts+34−0test/session/pricing.test.ts+22−1test/webDesktopRoutes.test.ts+3−3