ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-12 21:53:00 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(crabbox): bound IMDS identity checks (#108165)

Browse Source
This commit is contained in:
Alix-007
2026-07-16 13:32:29 +08:00
committed by GitHub
parent 774cd25aa6
commit 527711d27c
2 changed files with 20 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/crabbox-untrusted-bootstrap.sh
+2 -2
View File
@@ -13,12 +13,12 @@ shift
unset NODE_OPTIONS
imds_token="$(
/usr/bin/curl -fsS -X PUT \
/usr/bin/curl -fsS --connect-timeout 2 --max-time 5 -X PUT \
-H "X-aws-ec2-metadata-token-ttl-seconds: 60" \
http://169.254.169.254/latest/api/token
)"
iam_status="$(
/usr/bin/curl -sS -o /dev/null -w "%{http_code}" \
/usr/bin/curl -sS --connect-timeout 2 --max-time 5 -o /dev/null -w "%{http_code}" \
-H "X-aws-ec2-metadata-token: ${imds_token}" \
http://169.254.169.254/latest/meta-data/iam/security-credentials/
)"
test/scripts/crabbox-untrusted-bootstrap.test.ts
+18
View File
@@ -0,0 +1,18 @@
// Crabbox untrusted bootstrap tests cover the pre-execution identity boundary.
import { readFileSync } from "node:fs";
import { describe, expect, it } from "vitest";
describe("scripts/crabbox-untrusted-bootstrap.sh", () => {
it("bounds both IMDSv2 identity requests", () => {
const script = readFileSync("scripts/crabbox-untrusted-bootstrap.sh", "utf8");
const imdsRequests = script.match(
/\/usr\/bin\/curl[\s\S]*?http:\/\/169\.254\.169\.254[^\n]*/gu,
);
expect(imdsRequests).toHaveLength(2);
for (const request of imdsRequests ?? []) {
expect(request).toContain("--connect-timeout 2");
expect(request).toContain("--max-time 5");
}
});
});