mirror of https://github.com/garrytan/gstack.git
fa754092e3
isRootToken's length check compared JS string lengths, but the buffers passed to crypto.timingSafeEqual are UTF-8 byte representations. A multibyte token whose JS string length matches rootToken (e.g. "é".repeat(20), 20 chars / 40 bytes, vs a 20-byte ASCII root) would slip past the length check and crash inside timingSafeEqual on the mismatched-buffer-size invariant, turning a 401/403 auth-rejection path into an unhandled exception. Switch the short-circuit to Buffer.byteLength(token, 'utf8') and build the comparison buffers with explicit 'utf8' encoding. Regression tests cover: multibyte input with matching string length but differing byte length (the actual bug, asserts not.toThrow plus false), differing-length tokens (short-circuit branch), same-length differ-by- last-byte (timingSafeEqual branch), and empty string when root is set. Caught by Codex during pre-landing review of #1171. |
||
|---|---|---|
| .. | ||
| bin | ||
| scripts | ||
| src | ||
| test | ||
| PLAN-snapshot-dropdown-interactive.md | ||
| SKILL.md | ||
| SKILL.md.tmpl | ||