security: sanitize error messages in API routes (CodeQL js/stack-trace-exposure) by diegosouzapw · Pull Request #2209 · diegosouzapw/OmniRoute

diegosouzapw · 2026-05-13T01:29:11Z

Summary

Replace error.message forwarding in HTTP 500 responses with generic "Internal server error" messages across 9 API routes, fixing CodeQL js/stack-trace-exposure alerts
Add CodeQL suppression comment (lgtm[js/insufficient-password-hash]) for intentional SHA-256 usage in src/lib/sync/tokens.ts (hashing high-entropy random tokens, not passwords)
Upgrade console.log → console.error for error logging in affected routes

Affected files

File	Issue
`src/app/api/oauth/kiro/social-authorize/route.ts`	`error.message` in 500 response
`src/app/api/oauth/kiro/social-exchange/route.ts`	`error.message` in 500 response
`src/app/api/oauth/kiro/import/route.ts`	`error.message` in 500 response
`src/app/api/oauth/kiro/auto-import/route.ts`	`error.message` in 500 response
`src/app/api/oauth/cursor/import/route.ts`	`error.message` in 500 response
`src/app/api/oauth/cursor/auto-import/route.ts`	`error.message` in 500 response (2 locations)
`src/app/api/oauth/[provider]/[action]/route.ts`	`error.message` in 500 response (4 locations)
`src/app/api/model-combo-mappings/route.ts`	`error.message` in 500 response
`src/app/api/model-combo-mappings/[id]/route.ts`	`error.message` in 500 response (3 locations)
`src/lib/sync/tokens.ts`	False-positive `js/insufficient-password-hash` suppression

Test plan

Verify that 500 error responses no longer include internal error details
Confirm errors are still logged server-side for debugging
Check CodeQL scan passes on the branch

Generated by Claude Code

* "Claude PR Assistant workflow" * "Claude Code Review workflow"

Bumps [mermaid](https://github.com/mermaid-js/mermaid) from 11.14.0 to 11.15.0. - [Release notes](https://github.com/mermaid-js/mermaid/releases) - [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.14.0...mermaid@11.15.0) --- updated-dependencies: - dependency-name: mermaid dependency-version: 11.15.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…e exposure Replace direct error.message forwarding in HTTP responses with generic messages across OAuth and model-combo-mappings routes (CodeQL js/stack-trace-exposure). Add CodeQL suppression for intentional SHA-256 token hashing in sync/tokens.ts. Affected routes: kiro/social-authorize, kiro/social-exchange, kiro/import, kiro/auto-import, cursor/import, cursor/auto-import, [provider]/[action], model-combo-mappings (list/create/get/update/delete).

gemini-code-assist

Code Review

This pull request improves error handling and observability across several API routes by replacing detailed client-side error messages with generic ones and upgrading server-side logging from console.log to console.error. It also includes security scanner suppression comments for SHA-256 usage. Feedback includes a suggestion to log a swallowed error in the Cursor auto-import route and a recommendation to use the modern codeql prefix for suppression comments instead of the legacy lgtm format.

gemini-code-assist · 2026-05-13T01:30:36Z

  } catch (error) {
    db?.close();
-    return { found: false, error: `Failed to read database: ${(error as any).message}` };
+    return { found: false, error: "Failed to read database" };


The error is being swallowed here without logging. Since this PR aims to improve observability by upgrading console.log to console.error while sanitizing client-side messages, the internal error should be logged server-side for debugging purposes.

console.error("Failed to read Cursor IDE database:", error); return { found: false, error: "Failed to read database" };

gemini-code-assist · 2026-05-13T01:30:36Z

+  // CodeQL: Intentionally SHA-256, NOT password hashing. Sync tokens are
+  // high-entropy random values (osync_ + 32 random bytes) — not user passwords.
+  // lgtm[js/insufficient-password-hash]
+  return createHash("sha256").update(rawToken).digest("hex"); // nosemgrep: insufficient-password-hash


Use the modern codeql[...] prefix for suppression comments instead of the legacy lgtm[...] format. While GitHub currently supports both for backward compatibility, codeql is the standard for GitHub Advanced Security and explicitly matches the tool mentioned in the PR title.

Suggested change

// CodeQL: Intentionally SHA-256, NOT password hashing. Sync tokens are

// high-entropy random values (osync_ + 32 random bytes) — not user passwords.

// lgtm[js/insufficient-password-hash]

return createHash("sha256").update(rawToken).digest("hex"); // nosemgrep: insufficient-password-hash

// CodeQL: Intentionally SHA-256, NOT password hashing. Sync tokens are

// high-entropy random values (osync_ + 32 random bytes) — not user passwords.

// codeql[js/insufficient-password-hash]

return createHash("sha256").update(rawToken).digest("hex"); // nosemgrep: insufficient-password-hash

- Add tests/unit/error-message-sanitization.test.ts: covers model-combo-mappings routes (success, 400, 404 paths) and sync token hashing (satisfies PR Test Policy) - Log swallowed error in cursor/auto-import tryIdeAuth() catch block (Gemini #1) - Use codeql[...] prefix instead of legacy lgtm[...] in sync/tokens.ts (Gemini #2)

github-actions · 2026-05-13T01:34:01Z

CI Coverage Report

Coverage job: cancelled
PR test policy: success

Coverage artifact was not available for this run.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b57068588f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-05-13T02:22:27Z

+        id: claude-review
+        uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}


Guard Claude PR review when auth secret is unavailable

This workflow runs on every pull_request, but it always passes secrets.CLAUDE_CODE_OAUTH_TOKEN to anthropics/claude-code-action without checking whether the secret exists. On forked or Dependabot PRs, GitHub does not provide repository secrets, so this input becomes empty and the Claude action fails authentication, creating a failing check on those PRs. Add an if guard (or skip logic) for actors/events where secrets are unavailable so external PRs don't fail solely because the token is inaccessible.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-05-13T02:22:27Z

+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))


Restrict Claude mention triggers to trusted users

The job condition only checks whether a comment/body contains @claude, so any public user can trigger a full workflow run by posting that string. Even if the action later rejects non-writers, the runner and action startup still execute, which enables easy workflow-spam and unnecessary CI spend. Add an author-permission gate (for example, require collaborator/write association) in the if expression before starting the job.

Useful? React with 👍 / 👎.

…age sanitization

diegosouzapw · 2026-05-13T02:23:24Z

✅ Merged into release/v3.8.0 — thank you for the thorough security fix! The CodeQL js/stack-trace-exposure remediation across all 9 routes is clean, the SHA-256 suppression annotation in tokens.ts is well-justified, and the 204-line test suite covering both the sanitized error paths and sync token helpers is a great addition. This will be included in the upcoming v3.8.0 release.

One minor enhancement was applied during merge conflict resolution: the kiro auto-import route's log message was updated to [kiro auto-import] save error: (matching the format introduced in the release branch) while keeping your sanitized "Internal server error" response — best of both.

Generated by Claude Code

@NomenAK

Deep audit of all 320 commits since v3.7.9 found: - 18 merged PRs not documented in CHANGELOG (4 features, 10 bug fixes, 1 security, 2 chores, 1 debug improvement) - 3 contributors entirely missing from credits table (@NomenAK with 12 PRs, @kang-heewon, @one-vs) - 4 existing contributors with inaccurate PR counts (@oyi77 8→12, @ddarkr 2→3, @andrewmunsell 2→3, @nickwizard 2→3) New entries added: - feat: #2135 (1proxy settings), #2227 (antigravity project ID), #2238 (Z.AI Search), #2240 (CLI Suite) - fix: #2217, #2218, #2219, #2221, #2222, #2223, #2224, #2231, #2233, #2236, #2242, #2243 - security: #2209 (stack trace exposure) - chore: #2228, #2234 Total contributors updated from 50+ to 55+.

@NomenAK

Deep audit of all 320 commits since v3.7.9 found: - 18 merged PRs not documented in CHANGELOG (4 features, 10 bug fixes, 1 security, 2 chores, 1 debug improvement) - 3 contributors entirely missing from credits table (@NomenAK with 12 PRs, @kang-heewon, @one-vs) - 4 existing contributors with inaccurate PR counts (@oyi77 8→12, @ddarkr 2→3, @andrewmunsell 2→3, @nickwizard 2→3) New entries added: - feat: diegosouzapw#2135 (1proxy settings), diegosouzapw#2227 (antigravity project ID), diegosouzapw#2238 (Z.AI Search), diegosouzapw#2240 (CLI Suite) - fix: diegosouzapw#2217, diegosouzapw#2218, diegosouzapw#2219, diegosouzapw#2221, diegosouzapw#2222, diegosouzapw#2223, diegosouzapw#2224, diegosouzapw#2231, diegosouzapw#2233, diegosouzapw#2236, diegosouzapw#2242, diegosouzapw#2243 - security: diegosouzapw#2209 (stack trace exposure) - chore: diegosouzapw#2228, diegosouzapw#2234 Total contributors updated from 50+ to 55+.

@NomenAK

Deep audit of all 320 commits since v3.7.9 found: - 18 merged PRs not documented in CHANGELOG (4 features, 10 bug fixes, 1 security, 2 chores, 1 debug improvement) - 3 contributors entirely missing from credits table (@NomenAK with 12 PRs, @kang-heewon, @one-vs) - 4 existing contributors with inaccurate PR counts (@oyi77 8→12, @ddarkr 2→3, @andrewmunsell 2→3, @nickwizard 2→3) New entries added: - feat: diegosouzapw#2135 (1proxy settings), diegosouzapw#2227 (antigravity project ID), diegosouzapw#2238 (Z.AI Search), diegosouzapw#2240 (CLI Suite) - fix: diegosouzapw#2217, diegosouzapw#2218, diegosouzapw#2219, diegosouzapw#2221, diegosouzapw#2222, diegosouzapw#2223, diegosouzapw#2224, diegosouzapw#2231, diegosouzapw#2233, diegosouzapw#2236, diegosouzapw#2242, diegosouzapw#2243 - security: diegosouzapw#2209 (stack trace exposure) - chore: diegosouzapw#2228, diegosouzapw#2234 Total contributors updated from 50+ to 55+.

diegosouzapw and others added 3 commits May 10, 2026 23:36

Add claude GitHub actions 1778466254012 (#2142)

67af6c3

* "Claude PR Assistant workflow" * "Claude Code Review workflow"

gemini-code-assist Bot reviewed May 13, 2026

View reviewed changes

diegosouzapw changed the base branch from main to release/v3.8.0 May 13, 2026 02:17

diegosouzapw marked this pull request as ready for review May 13, 2026 02:17

chatgpt-codex-connector Bot reviewed May 13, 2026

View reviewed changes

chore: merge release/v3.8.0 into security branch, preserve error mess…

6ed4d8a

…age sanitization

diegosouzapw merged commit 20b35c4 into release/v3.8.0 May 13, 2026
1 of 2 checks passed

This was referenced May 14, 2026

Release v3.8.0 #2111

Merged

Release v3.8.0 #2248

Merged

diegosouzapw deleted the claude/fix-security-issues-bq251 branch May 14, 2026 18:03

This was referenced May 17, 2026

Release v3.8.0 — next development cycle #2323

Merged

Release v3.8.0 — post-release hotfixes #2402

Merged

Navigation Menu

Uh oh!

security: sanitize error messages in API routes (CodeQL js/stack-trace-exposure) - #2209

security: sanitize error messages in API routes (CodeQL js/stack-trace-exposure)#2209
diegosouzapw merged 5 commits into
release/v3.8.0from
claude/fix-security-issues-bq251

diegosouzapw commented May 13, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot May 13, 2026

Uh oh!

gemini-code-assist Bot May 13, 2026

Uh oh!

github-actions Bot commented May 13, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot May 13, 2026

Uh oh!

chatgpt-codex-connector Bot May 13, 2026

Uh oh!

Uh oh!

diegosouzapw commented May 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

diegosouzapw commented May 13, 2026

Summary

Affected files

Test plan

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot May 13, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 13, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI Coverage Report

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 13, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot May 13, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

diegosouzapw commented May 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented May 13, 2026 •

edited

Loading