Kamil Myśliwiec a1908877ae fix(core,websockets): run transient enhancers bound to static gateways ...

A default-scoped gateway with no scoped global enhancers builds its
message handlers once, in the static context and without an inquirer
id, and the injector constructed the transient enhancers of a static
provider for entry providers only. A transient guard bound to such a
gateway with @UseGuards() was then looked up as the placeholder whose
constructor never ran. With an arrow-function canActivate it was
skipped, so the handler ran for any client; with a prototype method it
ran without its dependencies.

The bootstrap load of every static provider now constructs its
transient enhancers with the provider as the inquirer, and the static
handlers of a gateway are created with its id as the inquirer, as those
of controllers and entry providers are. Such guards now run.

Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-J6VYP0AI.

2026-10-16 15:22:06 +02:00

..

e2e

fix(core,websockets): run transient enhancers bound to static gateways

2026-10-16 15:22:06 +02:00

src

fix(core): resolve durable global filters with the strategy's context id (#17930)

2026-09-30 10:08:13 +02:00

tsconfig.json

test: fix coverage collection, add more tests

2026-02-11 20:44:14 +01:00