CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-18 02:42:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): terminal-agent uses the shared PTY cookie parser

Browse Source 
The /ws upgrade's cookie fallback hand-parsed the Cookie header inline — the
fourth copy of the session-cookie parse, and the one that had already
diverged from the others. Parsing now goes through extractPtyCookie;
validation deliberately stays against the agent's own in-process validTokens
map (the server's registry lives in a different process). The ws-handler pin
test now pins the shared-parser call instead of the raw cookie-name literal.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-08-14 21:12:21 -07:00
co-authored by Claude Fable 5
parent 5df153d0b1
commit 7c309f7817
2 changed files with 11 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
browse/test/terminal-agent.test.ts
+4 -2
View File
@@ -121,9 +121,11 @@ describe('Source-level guard: terminal-agent', () => {
test('validates the session token against an in-memory token set', () => {
const wsHandler = AGENT_SRC.slice(AGENT_SRC.indexOf("if (url.pathname === '/ws')"));
// Two transports: Sec-WebSocket-Protocol (preferred for browsers) and
// Cookie gstack_pty (fallback). Both verify against validTokens.
// the gstack_pty cookie fallback — parsing shared via extractPtyCookie
// (the hand-rolled parse here had drifted from the server's), validation
// still against the agent's own validTokens map.
expect(wsHandler).toContain('sec-websocket-protocol');
expect(wsHandler).toContain('gstack_pty');
expect(wsHandler).toContain('extractPtyCookie');
expect(wsHandler).toContain('validTokens.has');
});