mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
J3vb
605f97051a
The closure rationale for audit finding #4 claimed in five places that nothing in the server calls EventSink.Dispatch. That is disprovable by grep: ws/hub.go:1034 calls Dispatch on every broadcast message, and api/router.go:134-139 wires h.pluginSink whenever plugins are enabled. The call site is pre-existing on main, not introduced by this branch. Restate the closure on the claim the evidence actually supports: Dispatch has exactly one caller outside the plugin package's tests (ws/hub.go, on the hub's broadcast goroutine under seqMu), but its loop body invokes no guest code and no production code calls Subscribe, so the subscriber set is always empty and no guest code executes on the event path. Finding #4 stays closed; the reason changes. Also warn on Subscribe that adding the first production caller turns Dispatch's loop live on the hub's hot path, and note in the SECURITY GATE that the call site already exists so wiring delivery is not a new integration. Corrected in: plugin/host_events.go (Dispatch + Subscribe comments), plugin/audit_closure_test.go, docs/audit-2026-04-07.md (row 4 and the structural-mitigation paragraph), docs/audit-2026-07-19.md §1 row, docs/plans/audit-2026-07-19-decisions.md D11. Comments and docs only — no behaviour change.