Repository navigation
fix(auth): compare API keys by value; read note headers as data only - #23
Merged
Merged
Conversation
The key was used to look up a property of a plain object, which also finds the names every object inherits. Keys are now compared with each configured key in constant time, in one function used by the API-key middleware and by the Brain API gate, which moves to its own module so it can be tested. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A note header that names another language is refused, so nothing in a note is ever run. Every reader of note headers now goes through one function. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ts with a rule line Writing a note passed its body back through the header parser. The body is now written unchanged. A first line of four or more dashes is ordinary text again. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What was wrong
constructor,toString,__proto__, …), so sending one of those names as the key was accepted as a valid key on/api/v1and on the MCP endpoint.The fix
serviceForKey()compares the given key with each configured key by value, in constant time. The API-key middleware and the Brain API gate both use it. The gate moved tosrc/middleware/brain-auth.jsso it can be tested.readNote()/writeNote()insrc/utils/frontmatter.jsread note headers as YAML data only, refuse a header that names another language, and write a body unchanged. Every reader goes through them. A first line of four or more dashes is ordinary text.Tests
tests/auth-bypass.test.js(7) andtests/frontmatter-safe.test.js(7); each failed before the fix.Note for self-hosters
Update and restart. The bug did not reveal any key: it let a request in without one. Keys do not need to be changed for this bug.
🤖 Generated with Claude Code