Skip to content

fix(security): redact public Firebase Web key (secret-scanning #7) + document SHA-256 cache-key (code-scanning #261) #2894

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
diegosouzapw merged 1 commit into from
May 29, 2026
+8 −2
Merged

fix(security): redact public Firebase Web key (secret-scanning #7) + document SHA-256 cache-key (code-scanning #261) #2894

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions docs/superpowers/specs/2026-05-29-windsurf-login-fix-design.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ Akibatnya user tidak bisa login ke Windsurf via OmniRoute. Provider effectively
```

Konstanta publik yang harus di-embed (extracted from Windsurf extension.js, public Firebase Web key — bukan secret):
- `FIREBASE_API_KEY = "AIzaSyDsOl-1XpT5err0Tcnx8FFod1H8gVGIycY"`
- `FIREBASE_API_KEY = "<REDACTED-public-firebase-web-key>"`
- `GOOGLE_CLIENT_ID = "957777847521-egrk5uakal87pjkqctk89fe7b7qtd1dq.apps.googleusercontent.com"`
- `REGISTER_SERVER = "https://register.windsurf.com"`

Expand Down Expand Up @@ -189,7 +189,7 @@ Restore browser-based login automation. User klik tombol Google/GitHub/Microsoft
| File | Change |
|---|---|
| `src/lib/oauth/constants/oauth.ts` | Add `WINDSURF_FIREBASE_CONFIG` block: `firebaseApiKey` via `resolvePublicCred("windsurf_fb", "WINDSURF_FIREBASE_API_KEY")`, `googleClientId` via `resolvePublicCred("windsurf_google", "WINDSURF_GOOGLE_CLIENT_ID")`, `registerUrl: "https://register.windsurf.com"`, `firebaseAuthUrl`, `firebaseTokenUrl`, OAuth redirect uri `https://windsurf.com/login`. |
| `open-sse/utils/publicCreds.ts` | Add embedded defaults: `windsurf_fb: "AIzaSyDsOl-1XpT5err0Tcnx8FFod1H8gVGIycY"`, `windsurf_google: "957777847521-egrk5uakal87pjkqctk89fe7b7qtd1dq.apps.googleusercontent.com"`. Both are public Web keys/client_ids — non-sensitive but must follow rule #11 pattern. |
| `open-sse/utils/publicCreds.ts` | Add embedded defaults: `windsurf_fb: "<REDACTED-public-firebase-web-key>"`, `windsurf_google: "957777847521-egrk5uakal87pjkqctk89fe7b7qtd1dq.apps.googleusercontent.com"`. Both are public Web keys/client_ids — non-sensitive but must follow rule #11 pattern. |
| `src/lib/oauth/providers/index.ts` | Register `"windsurf-firebase"` provider entry. |
| `src/lib/db/migrations/<NNN>_windsurf_firebase.sql` | Add columns to `connections`: `firebase_refresh_token TEXT NULL` (encrypted), `firebase_expires_at INTEGER NULL`. Idempotent (`IF NOT EXISTS` pattern). |
| `src/lib/db/connections.ts` | Update CRUD to handle new optional columns. Encrypt/decrypt via existing `connectionEncryption` helpers. |
Expand Down
6 changes: 6 additions & 0 deletions open-sse/executors/inner-ai.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,12 @@ function lruSet<V>(map: Map<string, V>, key: string, value: V): void {
}
}

// SHA-256 here derives an in-memory cache key from the session token — it is NOT
// password-at-rest storage. The slow KDFs CWE-916 recommends (bcrypt/scrypt/Argon2)
// are salted and non-deterministic, so they cannot be used as a stable Map key and
// would defeat the cache entirely. CodeQL js/insufficient-password-hash flags this as
// a false positive (dismissed); a fast cryptographic digest is the correct primitive
// for keying an ephemeral, process-local cache.
function tokenCacheKey(token: string): string {
return createHash("sha256").update(token).digest("hex");
}
Expand Down