fix(ws): block custom credential headers on redirects - #2429
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Castiron custom code✅ No new custom-code files detected. 34 mixed files remain; 0 existing customizations changed. Compared 34 existing customizations unchanged
A changed generated baseline means this report cannot reliably identify which handwritten lines changed. Inspect the custom-code diffDownload the exact patch produced by this run (requires repository access): gh run download 32328082743 --repo openai/openai-node \
--name castiron-custom-code-32328082743-1 --dir /tmp/castiron-custom-code-32328082743-1
git apply --stat /tmp/castiron-custom-code-32328082743-1/custom-code.patch
cat /tmp/castiron-custom-code-32328082743-1/custom-code.patchOr reproduce it from an SDK checkout containing the vendored reporter: git fetch --no-tags origin a0d68cc53125c2cb82eab31271b8984b8d65d4b2 39ff2fec0fb0be9f722dc686e2d7f3894678b9bc
python3 scripts/castiron/custom_code_report.py report \
--base a0d68cc53125c2cb82eab31271b8984b8d65d4b2 \
--head 39ff2fec0fb0be9f722dc686e2d7f3894678b9bc --fetch --require-head-hash --public \
--out /tmp/castiron-custom-code-39ff2fec0fb0
cat /tmp/castiron-custom-code-39ff2fec0fb0/custom-code.patchThis is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9f4e2e1b62
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 889c0cc9b1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
jbeckwith-oai
left a comment
jbeckwith-oai
left a comment
There was a problem hiding this comment.
Independent two-pass security review of the updated head confirms the previous X-Authentication-Token bypass was fixed, but the existing new High finding remains: other supported caller credential headers such as X-Refresh-Token, X-ID-Token, and X-Bearer-Token still evade name matching and are forwarded cross-origin by both public Responses WebSocket clients. Prevent cross-origin forwarding for arbitrary caller headers or use a safe allowlist rather than extending an inherently incomplete credential denylist. Existing exact-head inline thread already covers this; no duplicate comment added.
2 participants
Summary
Validation