CodeQL flagged 3 new alerts on the v0.9.0 develop → main promotion (#755). Both high alerts are low practical severity, so v0.9.0 shipped with a tracked follow-up (per maintainer decision) rather than blocking the release. This issue tracks the fixes.
1. High — modulo bias on crypto-random redemption codes
ornn-api/src/domains/redemption-codes/service.ts:127
out += REDEMPTION_CODE_ALPHABET[bytes[i]! % REDEMPTION_CODE_ALPHABET.length];
byte % 31 introduces a ~1.5% modulo bias (256 % 31). The code comments already acknowledge this as accepted for human-shareable promo codes (not security tokens; unique index + retry loop absorbs collisions). Still, it's a real high-rated finding.
Fix: use rejection sampling or crypto.randomInt(0, REDEMPTION_CODE_ALPHABET.length) per character to remove the bias. Keep existing generation tests green.
2. High — polynomial-backtracking regex in TS SDK
sdk/typescript/src/client.ts:70
this.baseUrl = options.baseUrl.replace(/\/+$/, "");
CodeQL flags \/+$ as polynomial ReDoS on "uncontrolled" input. In practice baseUrl is a developer-set config value and the TS SDK is not yet published (held for v1.0). Low exposure, but worth removing the backtracking shape.
Fix: drop the regex — strip trailing slashes with a non-regex loop/slice, or anchor a linear pattern. Add a unit test.
3. Medium/warning — workflow token permissions
.github/workflows/ci.yml:87 — add an explicit permissions: block (minimal contents: read) to the CI workflow.
Acceptance
Related: shipped in v0.9.0 (#753).
CodeQL flagged 3 new alerts on the v0.9.0
develop → mainpromotion (#755). Both high alerts are low practical severity, so v0.9.0 shipped with a tracked follow-up (per maintainer decision) rather than blocking the release. This issue tracks the fixes.1. High — modulo bias on crypto-random redemption codes
ornn-api/src/domains/redemption-codes/service.ts:127byte % 31introduces a ~1.5% modulo bias (256 % 31). The code comments already acknowledge this as accepted for human-shareable promo codes (not security tokens; unique index + retry loop absorbs collisions). Still, it's a real high-rated finding.Fix: use rejection sampling or
crypto.randomInt(0, REDEMPTION_CODE_ALPHABET.length)per character to remove the bias. Keep existing generation tests green.2. High — polynomial-backtracking regex in TS SDK
sdk/typescript/src/client.ts:70CodeQL flags
\/+$as polynomial ReDoS on "uncontrolled" input. In practicebaseUrlis a developer-set config value and the TS SDK is not yet published (held for v1.0). Low exposure, but worth removing the backtracking shape.Fix: drop the regex — strip trailing slashes with a non-regex loop/slice, or anchor a linear pattern. Add a unit test.
3. Medium/warning — workflow token permissions
.github/workflows/ci.yml:87— add an explicitpermissions:block (minimalcontents: read) to the CI workflow.Acceptance
randomInt).baseUrltrailing-slash strip has no backtracking regex.ci.ymldeclares an explicitpermissionsblock.Related: shipped in v0.9.0 (#753).