Feat/agent mode #9290
Feat/agent mode #9290
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
|
👍 @arvinxx Thank you for raising your pull request and contributing to our Community |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #9290 +/- ##
==========================================
+ Coverage 79.65% 79.86% +0.21%
==========================================
Files 826 260 -566
Lines 53449 15592 -37857
Branches 5626 3000 -2626
==========================================
- Hits 42575 12453 -30122
+ Misses 10874 3139 -7735
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
arvinxx
force-pushed
the
feat/agent-mode
branch
from
8019834 to
89e11db
Compare
arvinxx
force-pushed
the
feat/agent-mode
branch
from
3182185 to
2341bb4
Compare
| } | ||
|
|
||
| // Generate runtime session ID | ||
| const runtimeSessionId = `agent_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`; |
Check failure
Code scanning / CodeQL
Insecure randomness High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 5 days ago
To fix the problem, we should replace the usage of Math.random() for generating a portion of the runtimeSessionId with a value produced by Node.js's crypto.randomBytes(), which is considered cryptographically secure. The fix involves importing the crypto module from Node.js and generating a random string by converting generated random bytes to hexadecimal or base64, then incorporating that value into the session ID format.
Specifically, within the file src/server/routers/lambda/aiAgent.ts, the line:
const runtimeSessionId = `agent_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;should be changed to use crypto.randomBytes(6).toString('base64url') (or 'hex'), which will give a sufficiently random unique value. Additionally, an import statement for crypto should be added at the top of the file if it doesn't exist.
| @@ -8,6 +8,7 @@ | ||
| import { serverDatabase } from '@/libs/trpc/lambda/middleware'; | ||
| import { AgentRuntimeService } from '@/server/services/agentRuntime'; | ||
|
|
||
| import * as crypto from 'crypto'; | ||
| // Zod schemas for agent session operations | ||
| const CreateAgentSessionSchema = z.object({ | ||
| agentConfig: z.record(z.any()).optional().default({}), | ||
| @@ -95,8 +96,9 @@ | ||
| }); | ||
| } | ||
|
|
||
| // Generate runtime session ID | ||
| const runtimeSessionId = `agent_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`; | ||
| // Generate runtime session ID using cryptographically secure randomness | ||
| const randomSegment = crypto.randomBytes(6).toString('base64url'); | ||
| const runtimeSessionId = `agent_${Date.now()}_${randomSegment}`; | ||
|
|
||
| pino.info(`Creating session ${runtimeSessionId} for user ${ctx.userId}`); | ||
|
|
arvinxx
force-pushed
the
feat/agent-mode
branch
from
2341bb4 to
96d0678
Compare
arvinxx
force-pushed
the
feat/agent-mode
branch
from
96d0678 to
176caee
Compare
arvinxx
force-pushed
the
feat/agent-mode
branch
from
176caee to
d9717bd
Compare
💻 变更类型 | Change Type
🔀 变更说明 | Description of Change
📝 补充信息 | Additional Information