fix(security): crypto UUIDs for RPC correlation ids - #47
Merged
Conversation
RPC correlation / frame ids in the web bridge, web auth, and extension provider-auth were minted with Math.random(), which flowed into request-id sinks and tripped CodeQL js/insecure-randomness (High). Switch them to crypto.randomUUID (node:crypto in the extension's Node context, global crypto in the browser). Genuinely non-sink Math.random is kept: reconnect-backoff jitter and the crypto-first, local-only newTraceId fallback. Adds a failing-first test asserting the auth correlation id is a UUID.
lsiddiquee
force-pushed
the
fix/insecure-randomness-and-fast-uri
branch
from
July 22, 2026 13:14
a888ebe to
3e470ee
Compare
lsiddiquee
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
CodeQL
js/insecure-randomness(High): RPC correlation / frame ids were minted withMath.random()and flowed into request-id sinks (the alert surfaced at the dev-onlyweb-playgroundecho, but the tainted source wasweb's ids).What
crypto.randomUUID()—node:cryptoin the extension's Node context, globalcryptoin the browser — acrosswebbridge,webauth, andextensionprovider-auth. Failing-first test asserts the auth id is a UUID.Math.random: reconnect-backoff jitter and the crypto-first, local-onlynewTraceIdfallback.docs/06.Not in this PR — fast-uri (Dependabot #16)
Intentionally excluded. The patched fast-uri lines (2.4.3 / 3.1.4 / 4.1.1) are not mirrored on our feed proxy (newest available is the still-vulnerable 4.1.0), and a newer advisory (GHSA-v2hh-gcrm-f6hx) extended the affected range to
>= 4.0.0, <= 4.1.0— so no resolvable fix exists locally yet, and a still-vulnerable override would only faildependency-review. It's a dev-only transitive (ajv <- secretlint <- @vscode/vsce, never shipped). Deferred to Dependabot / once the proxy mirrors a patch; rationale captured indocs/06.Validation
pnpm -r build/typecheck/lintclean;pnpm -r testgreen (web 131 incl. new UUID test, extension 212, protocol 66, gateway 138).Guardrails
Zero code-sync; boundaries respected (extension uses
node:crypto); no new egress path; provenance untouched; no secrets logged.