ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-12 21:53:00 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): classify proxied APNs TLS tunnel (#110480)

Browse Source 
* fix(ci): classify proxied APNs TLS tunnel

* fix(ci): prove network CodeQL contract changes

Co-authored-by: zhang-guiping <zhang.guiping@xydigit.com>

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
This commit is contained in:
xingzhou
2026-07-18 23:18:29 +08:00
committed by GitHub
parent 63a32e360b
commit faf3dbdda8
3 changed files with 13 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/codeql/openclaw-boundary/queries/raw-socket-callsite-classification.ql
+2 -5
View File
@@ -62,13 +62,10 @@ predicate allowedRawSocketClientCall(Expr call) {
or or
allowedOwnerScope(call, "src/infra/ssh-tunnel.ts", "canConnectLocal") allowedOwnerScope(call, "src/infra/ssh-tunnel.ts", "canConnectLocal")
or or
allowedOwnerScope(call, "src/infra/gateway-lock.ts", "checkPortFree")
or
allowedOwnerScope(call, "src/infra/jsonl-socket.ts", "requestJsonlSocketWithMaxLineBytes") allowedOwnerScope(call, "src/infra/jsonl-socket.ts", "requestJsonlSocketWithMaxLineBytes")
or or
allowedOwnerScope(call, "src/infra/net/http-connect-tunnel.ts", "connectToProxy") // This TLS layer wraps the managed CONNECT socket; it cannot open a direct route.
or allowedOwnerScope(call, "src/infra/push-apns-http2.ts", "openApnsTlsTunnel")
allowedOwnerScope(call, "src/infra/net/http-connect-tunnel.ts", "startTargetTls")
or or
allowedOwnerScope(call, "src/infra/push-apns-http2.ts", "openProxiedApnsHttp2Session") allowedOwnerScope(call, "src/infra/push-apns-http2.ts", "openProxiedApnsHttp2Session")
or or
.github/workflows/codeql-critical-quality.yml
+5 -4
View File
@@ -447,6 +447,7 @@ jobs:
added_lines="$(mktemp)" added_lines="$(mktemp)"
raw_socket_scan_lines="$(mktemp)" raw_socket_scan_lines="$(mktemp)"
codex_transport="extensions/codex/src/app-server/transport-websocket.ts" codex_transport="extensions/codex/src/app-server/transport-websocket.ts"
network_codeql_contract_pattern='^\.github/codeql/(codeql-network-runtime-boundary-critical-quality\.yml|openclaw-boundary/queries/(raw-socket-callsite-classification|managed-proxy-runtime-mutation)\.ql)$'
gh api --paginate "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files" --jq '.[].filename' > "$changed_files" gh api --paginate "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files" --jq '.[].filename' > "$changed_files"
gh api --paginate "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files" --jq ' gh api --paginate "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files" --jq '
@@ -472,10 +473,10 @@ jobs:
| "\($file): \(.)" | "\($file): \(.)"
' > "$raw_socket_scan_lines" ' > "$raw_socket_scan_lines"
if grep -Fxq "$codex_transport" "$changed_files"; then # Query/config edits need semantic analysis; the fast diff scan cannot validate QL.
# This transport has an exact owner/function allowlist in the raw-socket # The Codex transport also has an exact owner/function allowlist in the query.
# CodeQL query, so its raw socket calls run there. Proxy policy tokens if grep -Eq "$network_codeql_contract_pattern" "$changed_files" || \
# remain in the fast scan below. grep -Fxq "$codex_transport" "$changed_files"; then
echo "full_codeql=true" >> "$GITHUB_OUTPUT" echo "full_codeql=true" >> "$GITHUB_OUTPUT"
else else
echo "full_codeql=false" >> "$GITHUB_OUTPUT" echo "full_codeql=false" >> "$GITHUB_OUTPUT"
test/scripts/ci-workflow-guards.test.ts
+6
View File
@@ -4998,6 +4998,12 @@ printf '%s\n' "\${CURL_SUCCESS_IP:-203.0.113.7}"
expect(workflow).toContain( expect(workflow).toContain(
'codex_transport="extensions/codex/src/app-server/transport-websocket.ts"', 'codex_transport="extensions/codex/src/app-server/transport-websocket.ts"',
); );
expect(workflow).toContain(
"network_codeql_contract_pattern='^\\.github/codeql/(codeql-network-runtime-boundary-critical-quality\\.yml|openclaw-boundary/queries/(raw-socket-callsite-classification|managed-proxy-runtime-mutation)\\.ql)$'",
);
expect(workflow).toContain(
'if grep -Eq "$network_codeql_contract_pattern" "$changed_files" ||',
);
expect(workflow).toContain( expect(workflow).toContain(
'| select(.filename != "extensions/codex/src/app-server/transport-websocket.ts")', '| select(.filename != "extensions/codex/src/app-server/transport-websocket.ts")',
); );