ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-12 21:53:00 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(browser): keep guarded CDP sockets on validated endpoints [AI] (#114506)

Browse Source 
* fix(browser): keep guarded CDP sockets on validated endpoints

* fix(browser): avoid retrying rate-limited CDP discovery

* fix(browser): close Chrome MCP CDP policy gaps

* test(browser): match Chrome MCP policy error

* test(browser): satisfy transport type and lint checks

* fix(browser): narrow guarded CDP transport changes

* fix(browser): separate upload filesystem locality

* fix(browser): keep strict remote CDP hosts untrusted
This commit is contained in:
Pavan Kumar Gondhi
2026-08-12 16:16:12 +05:30
committed by GitHub
parent 786c646d88
commit 92f5f07da1
52 changed files with 2584 additions and 529 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/tools/browser.md
+15
View File
@@ -316,6 +316,21 @@ main model can read the screenshot directly.
- Browser navigation and open-tab requests are preflight checked. During the action and bounded post-action grace, guarded Playwright interactions (click, coordinate click, hover, drag, scroll, select, press, type, form fill, and evaluate) intercept policy-denied top-level and subframe document loads before HTTP request bytes, then best-effort re-check the final `http(s)` URL.
- Before each fresh OpenClaw-managed Chrome launch, OpenClaw best-effort disables network prediction, suppressing Chromium's observed speculative preconnect for those denied loads. This is defense in depth, not a policy boundary: a browser reused across a control-service restart and other browser backends may not share the hardening. Playwright routing is still not a network firewall and does not intercept redirect hops, a popup's first request, Service Worker traffic, page code that runs after the bounded guard window, or every background/subresource path. Complete egress isolation requires owner-side isolation or a policy-enforcing proxy.
- In strict SSRF mode, remote CDP endpoint discovery and `/json/version` probes (`cdpUrl`) are checked too.
- Guarded remote CDP connections now fail closed when the selected driver cannot
keep the approved endpoint bound to the actual socket. Use the regular
`openclaw` driver for Browserless, Browserbase, Notte, or other guarded
remote CDP providers. `existing-session`/Chrome MCP profiles with an explicit
`cdpUrl` or `--browserUrl`/`--wsEndpoint` MCP argument are rejected under the
default strict Browser policy because Chrome MCP cannot carry OpenClaw's
pinned DNS lookup or guarded discovery result across its subprocess boundary.
They remain supported only when private-network Browser access is explicitly
trusted. Otherwise, omit the explicit endpoint and attach Chrome MCP to a
host-local Chrome profile, or switch the profile to the regular driver for
guarded CDP.
- Redirecting CDP discovery to a different authority remains unsupported unless
the active policy explicitly allows that authority change. Revalidating a
returned hostname is not enough; the WebSocket transport must use the endpoint
that passed policy validation.
- Gateway/provider `HTTP_PROXY`, `HTTPS_PROXY`, `ALL_PROXY`, and `NO_PROXY` environment variables do not automatically proxy the OpenClaw-managed browser. Managed Chrome launches direct by default so provider proxy settings do not weaken browser SSRF checks.
- OpenClaw-managed local CDP readiness probes and DevTools WebSocket connections bypass the managed network proxy for the exact launched loopback endpoint, so `openclaw browser start` still works when an operator proxy blocks loopback egress.
- To proxy the managed browser itself, pass explicit Chrome proxy flags through `browser.extraArgs`, such as `--proxy-server=...` or `--proxy-pac-url=...`. Strict SSRF mode blocks explicit browser proxy routing unless private-network browser access is intentionally enabled.