mirror of
https://github.com/software-mansion/argent.git
synced 2026-09-14 19:27:14 +08:00
Ignacy Łątka
81ab110e8b
Three defects found reviewing the forwarding path. Express matches mount paths case-insensitively, so `/PREVIEW/boot` reaches the same preview router as `/preview/boot` while a case-sensitive exclusion let it through — carrying a forged flag set past `requireLensFlag` on routes the auth gate exempts, on a `--no-auth` server with no token at all. The two questions now have two predicates: what the auth gate exempts stays an exact match, and what the flag gate skips is everything Express will route into that subtree. Skipping an override on a request that still needs a token costs nothing; exempting one from auth would not. `Buffer.from(…, "base64")` stops at the padding rather than rejecting what follows, so `<valid>GARBAGE` — and the comma-joined string Node builds from a duplicated header — decoded to the first payload, were acknowledged, and applied. The header value is now shape-checked before it is decoded. A forwarded `__proto__` is dropped, because the flags.json reader assigns onto a plain object where that key hits the prototype setter and stores nothing. The claimed disk/wire parity was false for exactly that name; a test now asserts it against the real reader instead of restating it. `argent link` also warns about an unacknowledged probe when no flags are set. An empty set is the strongest assertion in this protocol — it turns every flag-gated tool off — so a server that ignores it serves tools the CLI just said would be hidden. The earlier asymmetry had it backwards. Two prose fixes for claims this feature falsified: `requireLensFlag` no longer tracks the tool gate (it reads this machine's flags by design), and `argent enable` rejects a flag only a newer linked server knows, which its error message now says.