fix(security): replace insecure PRNG, harden JSON.parse, fix ESLint errors - #16
Merged
Conversation
…rrors Security fixes (CWE-338): - src/memory/agentdb/client.ts: replace Math.random() with crypto.randomBytes for ID generation; add top-level crypto import - src/memory/reasoning-bank/bank.ts: replace Math.random() with crypto.randomBytes for knowledge-unit ID generation; add top-level crypto import - Remove unused DEFAULT_SAFLA_CONFIG import from reasoning-bank/bank.ts Input hardening: - src/optimize/bootstrap.ts: wrap JSON.parse(readFileSync(...)) in try/catch with descriptive error message in load() - src/optimize/gepa.ts: same JSON.parse hardening in load() - src/optimize/miprov2.ts: same JSON.parse hardening in load() ESLint error fixes (0 errors, was 11): - src/core/factory.ts: remove phantom TResult from ModuleOptions interface; keep it on defineModule function signature - src/core/module.ts: remove unused FieldDefinition import - src/lm/onnx.ts: prefix unused 'tokens' parameter as '_tokens' - src/lm/torch.ts: prefix unused 'options' parameter as '_options' - src/modules/chain-of-thought.ts: let -> const for jsonMatch; drop unused error binding in catch clause - src/modules/react.ts: rename 'steps' param to '_steps'; let -> const for value (prefer-const) - src/types/js-pytorch.d.ts: fix no-misused-new by replacing interface new() signatures with separate LinearConstructor/ReLUConstructor interfaces All 177 tests pass; TypeScript compilation clean. Co-Authored-By: claude-flow <ruv@ruv.net>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security Fixes
CWE-338 — Insecure Pseudo-Random Number Generator
Two ID generators used
Math.random()which is not cryptographically secure and produces predictable values that can be guessed by an attacker:src/memory/agentdb/client.tsMath.random().toString(36)→crypto.randomBytes(5).toString('hex')src/memory/reasoning-bank/bank.tsMath.random().toString(36)Both files now use Node.js
crypto.randomBytesvia a top-levelimport { randomBytes } from 'crypto'.Unguarded JSON.parse on file input
Three
load()methods parsed file contents without error handling, meaning a malformed or corrupt saved-state file would throw an uncaught exception up the call stack with no context. Each now wrapsJSON.parse(readFileSync(...))in a try/catch that re-throws with the file path and original message:src/optimize/bootstrap.tssrc/optimize/gepa.tssrc/optimize/miprov2.tsESLint Error Fixes (11 → 0 errors)
src/core/factory.tsno-unused-varsTResultfromModuleOptionsinterface (kept on function)src/core/module.tsno-unused-varsFieldDefinitionimportsrc/lm/onnx.tsno-unused-varstokens→_tokens(intentionally unused param)src/lm/torch.tsno-unused-varsoptions→_options(intentionally unused param)src/modules/chain-of-thought.tsprefer-const,no-unused-varslet jsonMatch→const; emptycatchbinding removedsrc/modules/react.tsno-unused-vars,prefer-conststeps→_steps;let value→const valuesrc/types/js-pytorch.d.tsno-misused-newnew()signatures on interfaces with properLinearConstructor/ReLUConstructorinterfacesnpm Audit
npm auditreported 0 vulnerabilities before and after these changes. Thepackage.jsonalready containsoverridesforqs >= 6.15.0,protobufjs >= 7.5.8, andtar >= 7.5.11.Test Plan
npm audit— 0 vulnerabilitiesnpx tsc --noEmit— clean (0 errors)npx eslint 'src/**/*.ts'— 0 errors (147 pre-existing warnings, allno-explicit-any/ missing return types)npm test— 177/177 tests pass