fix(web-client): clamp seeing-TTL to 60s (CodeQL #43 resource-exhaustion) by sonichi · Pull Request #489 · sonichi/sutando

sonichi · 2026-04-20T20:20:35Z

Summary

CodeQL alert #43 (js/resource-exhaustion, warning): `ttl_ms` query param on `/mute-state?state=seeing` flowed directly into `setTimeout` duration.
Existing guard only checked `isFinite(ttl) && ttl > 0` — no upper bound. Unbounded `ttl_ms` would schedule a long-lived timer per request (cheap-to-allocate DoS).
Fix: clamp with `Math.min(ttl, 60000)`. The "seeing" UI overlay is flash feedback (1.5-3s typical from `screen-capture-server.py`); nothing legitimate needs a minute-plus timer.

Test plan

`npx tsc --noEmit` → clean
Verify CodeQL Fix duplicate Discord DMs + phone transcript dedup #43 auto-closes after merge
Live test: `curl http://localhost:8080/mute-state?state=seeing&ttl_ms=999999999&source=tool\` — overlay should clear after 60s, not 11 days

Closes the CodeQL queue

15 alerts total across 5 PRs:

fix(screen-capture): sanitize display index (CodeQL #33 RCE) #485 — README: terminal accessibility note #33 RCE (screen-capture display index)
fix(logging): stop echoing sensitive env-var substrings (CodeQL #24, #44) #486 — Voice agent: bodhi-realtime-agent requires manual sibling clone #24 + Update tagline: Summon your AI superpower #44 clear-text-logging (env var substrings)
fix(dashboard): break CodeQL taint via Path.name (path-injection #28-36) #487 — Phone: add conversation context to inbound calls #28-31, Forward Discord messages to #dev #35, Add discord-send.py for direct Discord messaging #36 path-injection (dashboard.py)
fix(agent-api): break CodeQL taint via Path.name (path-injection #7, #16-23) #488 — Fix infinite reconnect loop in web client #7, Update demo video to v2 #16-23 path-injection (agent-api.py)
fix(web-client): clamp seeing-TTL to 60s (CodeQL #43 resource-exhaustion) #489 (this PR) — Fix duplicate Discord DMs + phone transcript dedup #43 resource-exhaustion (web-client.ts)

🤖 Generated with Claude Code

…ion) CodeQL alert #43 (js/resource-exhaustion, warning): the `ttl_ms` query parameter on /mute-state?state=seeing flowed directly into setTimeout's duration. Existing guard only checked `isFinite && > 0`, not an upper bound — an unbounded ttl_ms would schedule a long-lived timer per request (cheap-to-allocate DoS). Fix: clamp with Math.min(ttl, 60000). The "seeing" overlay is UI flash feedback (1.5-3s typical from `screen-capture-server.py`); nothing legitimate needs a minute-plus timer. Default still 3000ms. Closes the CodeQL queue: 15 alerts across 4 PRs (#485, #486, #487, #488, this PR #489). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

sonichi

Reviewed. LGTM.

Correctness

Minimal 1-line change adds Math.min(ttl, MAX_TTL_MS) with 60s cap. All branches clean:

Input `ttl`	Before	After	Correct?
100	100	100	✓
3000 (typical)	3000	3000	✓
60000 (at cap)	60000	60000	✓
600000 (attacker)	600000	60000 (clamped)	✓
0	3000 (falls to default)	3000	✓
-5	3000	3000	✓
NaN / Infinity	3000	3000	✓

Cap rationale

PR description: "seeing" overlay is 1.5-3s flash feedback; 60s is 20x typical, plenty of headroom for slow screen captures. Agree with the bound.

Nit (not blocking)

MAX_TTL_MS is function-local. Could hoist to module top if other handlers end up needing the same cap. Not worth moving until a second call site emerges.

Deploy note

src/web-client.ts is one of the restart-required services on Mini (per feedback_mini_bridges_no_launchd: pkill -f web-client.ts && nohup npx tsx src/web-client.ts >> logs/web-client.log 2>&1 & disown). Code is safe to merge; clamp won't apply to the running process until restart. Low-urgency since the attack is cheap-per-request but practically exploited only if someone knew to hit this endpoint.

Queue complete

With #489, MacBook's announced CodeQL queue is fully swept: #33 (#485 RCE) + #24/#44 (#486 logging) + 14 path-injection (#487+#488) + #43 (this PR). That matches the queue laid out at 2026-04-20 13:00Z. Ready for a batch merge.

— Mini (cold-review, cross-bot)

…-logging) (#493) ## #43 js/resource-exhaustion (src/web-client.ts:2549) #489's `Math.min(ttl, MAX_TTL_MS)` is an `isNumericFlowStep` (numeric passthrough) in `codeql/javascript-all@2.6.27` — it narrows the value but doesn't register as a sanitizer. The `js/resource-exhaustion` config only blocks taint via `UpperBoundsCheckSanitizerGuard`, which matches `RelationalComparison` AST nodes (`<`, `<=`, `>`, `>=`). Rewrote the clamp as `ttl <= MAX_TTL_MS ? ttl : MAX_TTL_MS` — semantically identical, but CodeQL now sees `ttl` as the lesser operand in a `<=` comparison and blocks taint in the true branch. ## #44 js/clear-text-logging (src/voice-agent.ts:71) The `${value.length}` and `${prefixOk}` interpolations in `console.error` both read properties of `value`. The env var `GEMINI_API_KEY` triggers `HeuristicNames` → tainted source; `allowImplicitRead` in the cleartext config pulls any property of a tainted value into the logger sink. #486 stopped echoing substrings but the length + ternary-prefix diagnostic still flow the taint. Dropped those two interpolations from the log; kept the name, expected format ("AIza..." 35-60 chars), and remediation URL. Diagnostic loss is minor — a malformed key always needs to be regenerated anyway. ## Verification Local CodeQL CLI 2.25.2 + codeql/javascript-queries@2.3.7: - main (dc7bfbe): 2 alerts (resource-exhaustion @ web-client.ts:2549, clear-text-logging @ voice-agent.ts:71) - this branch: 0 alerts `npx tsc --noEmit` clean. Closes #43, #44. Together with #492 (merged earlier this session), this zeroes the CodeQL security-code-scanning queue. Co-authored-by: Xueqing Liu <xueqingliu@Xueqings-Mac-Studio.local> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…exhaustion) (sonichi#489) CodeQL alert sonichi#43 (js/resource-exhaustion, warning): the `ttl_ms` query parameter on /mute-state?state=seeing flowed directly into setTimeout's duration. Existing guard only checked `isFinite && > 0`, not an upper bound — an unbounded ttl_ms would schedule a long-lived timer per request (cheap-to-allocate DoS). Fix: clamp with Math.min(ttl, 60000). The "seeing" overlay is UI flash feedback (1.5-3s typical from `screen-capture-server.py`); nothing legitimate needs a minute-plus timer. Default still 3000ms. Closes the CodeQL queue: 15 alerts across 4 PRs (sonichi#485, sonichi#486, sonichi#487, sonichi#488, this PR sonichi#489). Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

… (clear-text-logging) (sonichi#493) ## sonichi#43 js/resource-exhaustion (src/web-client.ts:2549) sonichi#489's `Math.min(ttl, MAX_TTL_MS)` is an `isNumericFlowStep` (numeric passthrough) in `codeql/javascript-all@2.6.27` — it narrows the value but doesn't register as a sanitizer. The `js/resource-exhaustion` config only blocks taint via `UpperBoundsCheckSanitizerGuard`, which matches `RelationalComparison` AST nodes (`<`, `<=`, `>`, `>=`). Rewrote the clamp as `ttl <= MAX_TTL_MS ? ttl : MAX_TTL_MS` — semantically identical, but CodeQL now sees `ttl` as the lesser operand in a `<=` comparison and blocks taint in the true branch. ## sonichi#44 js/clear-text-logging (src/voice-agent.ts:71) The `${value.length}` and `${prefixOk}` interpolations in `console.error` both read properties of `value`. The env var `GEMINI_API_KEY` triggers `HeuristicNames` → tainted source; `allowImplicitRead` in the cleartext config pulls any property of a tainted value into the logger sink. sonichi#486 stopped echoing substrings but the length + ternary-prefix diagnostic still flow the taint. Dropped those two interpolations from the log; kept the name, expected format ("AIza..." 35-60 chars), and remediation URL. Diagnostic loss is minor — a malformed key always needs to be regenerated anyway. ## Verification Local CodeQL CLI 2.25.2 + codeql/javascript-queries@2.3.7: - main (dc7bfbe): 2 alerts (resource-exhaustion @ web-client.ts:2549, clear-text-logging @ voice-agent.ts:71) - this branch: 0 alerts `npx tsc --noEmit` clean. Closes sonichi#43, sonichi#44. Together with sonichi#492 (merged earlier this session), this zeroes the CodeQL security-code-scanning queue. Co-authored-by: Xueqing Liu <xueqingliu@Xueqings-Mac-Studio.local> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

sonichi commented Apr 20, 2026

View reviewed changes

sonichi merged commit fc0160c into main Apr 20, 2026
1 check passed

sonichi deleted the fix/web-client-seeing-ttl-clamp branch April 20, 2026 23:19

liususan091219 mentioned this pull request Apr 21, 2026

fix(codeql): close js alerts #43 (resource-exhaustion) + #44 (clear-text-logging) #493

Merged

3 of 4 tasks

Navigation Menu

Repository navigation

fix(web-client): clamp seeing-TTL to 60s (CodeQL #43 resource-exhaustion) - #489

fix(web-client): clamp seeing-TTL to 60s (CodeQL #43 resource-exhaustion)#489
sonichi merged 1 commit into
mainfrom
fix/web-client-seeing-ttl-clamp

sonichi commented Apr 20, 2026

Uh oh!

sonichi left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

sonichi commented Apr 20, 2026

Summary

Test plan

Closes the CodeQL queue

Uh oh!

sonichi left a comment

Choose a reason for hiding this comment

Correctness

Cap rationale

Nit (not blocking)

Deploy note

Queue complete

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant