cameri / nostream / 42091743421

78%

Build Type

push

github

Committed by web-flow

Commit Message

fix(cli): reject placeholder secret inherited from env or prompt in setup (#1018) (#1058)

Fixes #1018

### Overview

Addresses security finding **F-030 (weak cryptography / CWE-330)** where
`nostream setup` could report success while retaining the default
placeholder secret in `.env`.

### Problem

When running setup via the CLI, the package entry point preloads `.env`
into `process.env`. If `.env` contains the default placeholder
(`change_me_to_something_long_and_random`), `process.env.SECRET`
inherits that value.

Previously:
1. `resolveSecret()` checked `if (process.env.SECRET?.trim())` and
returned it without verifying whether it was the default placeholder.
2. `ensureEnvFile()` persisted this value back to `.env` without
secondary validation, resulting in setup completing while retaining an
insecure, predictable session signing secret.
3. The interactive secret prompt only validated that the input was
non-empty, allowing the default placeholder to be entered manually.

### Changes

- **Reject Inherited Placeholder**: Updated `resolveSecret()` in
`src/cli/commands/setup.ts` to check
`!needsSecretReplacement(inheritedSecret)` before accepting
`process.env.SECRET`.
- **Interactive Validation**: Extended prompt validation in
`setupPrompts.text` to reject the default placeholder string in addition
to empty input.
- **Defense-in-Depth Persistence Guard**: Added a validation check in
`ensureEnvFile()` before writing to disk; if the resolved secret is
empty or matches the placeholder, a secure 64-byte random hex secret
(`crypto.randomBytes(64)`) is generated.
- **Process Memory Synchronization**: Ensured `process.env.SECRET` is
updated with the final secret so downstream steps in the same process
(such as `runStart`) use the new secret immediately.
- **Unit Tests**: Added test coverage in `test/unit/cli/setup.spec.ts`
covering:
- Rejecting an inherited placeholder from `process.env.SECRET` and
generating a fresh random secret.
- Interactive prompt valid... (continued)

Coverage Stats

4840 of 6847 branches covered (70.69%)

Branch coverage included in aggregate %.

2 of 52 new or added lines in 1 file covered. (3.85%)

1 existing line in 1 file now uncovered.

10569 of 13040 relevant lines covered (81.05%)

707.14 hits per line