naibaandnaiba/CloudCode 280e34977f fix(rpc): enforce magic ff05ff05 on IOStream init ...

The inline magic check expressed the *invalid* form as
\`byte0 != 0xff && byte1 != 0x05 && byte2 != 0xff && byte3 == 0x05\`,
relying on && to detect a four-byte mismatch. Because && short-circuits,
any payload whose byte0 happened to be 0xff was treated as a valid magic
even if the remaining bytes did not match — almost every random payload
slipped through and only the stream-UUID layer above stood between a
caller with a valid agent secret and a live IOStream session.

Extract the check into isValidIOStreamMagic stated positively (all four
bytes must match) so short-circuit reasoning cannot reintroduce the bug.

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>

2026-05-18 15:17:18 +00:00

..

rpc

fix(rpc): enforce magic ff05ff05 on IOStream init

2026-05-18 15:17:18 +00:00

singleton

chore: bump admin frontend to v2.0.7

2026-05-17 10:24:19 +08:00