🔒 Fix memory leak of raw admin password#106
Conversation
🎯 What: The vulnerability fixed is the cleartext caching of the admin password in the environment configuration and in multiple middleware states.⚠️ Risk: If the service gets subjected to memory inspection or arbitrary file reads that hit process memory maps, the cleartext admin password could easily be exposed. 🛡️ Solution: Hashing operations and validation states are centralized via `validateAdminToken` in `relay/src/utils/security.ts`. The initial hash generation logic instantly clears `process.env.ADMIN_PASSWORD` from Node.js memory limits. All middlewares, index files, and tests were rewritten to use the new centralized abstraction instead of `authConfig.adminPassword`. Co-authored-by: scobru <1079164+scobru@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
1 participant
What: Prevent the raw process.env.ADMIN_PASSWORD from persisting in memory.
Risk: Cleartext memory retention could lead to inadvertent leakage or dump exposure.
Solution: Hashing is centralized in utils/security.ts with a cached closure, which immediately zeroes out the environment variable after generating the hash. The cleartext references in config and middleware instances have been completely removed and centralized to validateAdminToken().
PR created automatically by Jules for task 12006240448961593198 started by @scobru