mirror of
https://github.com/openclaw/openclaw.git
synced 2026-08-27 12:56:01 -06:00
Miorbnli
fe6b8bf1e4
* fix: prevent dollar-pattern injection in tilde expansion across extensions String.replace interprets dollar-amp/dollar-1/dollar-backtick in the replacement string. Eight call sites across extensions and memory-host-sdk expanded ~ using .replace(/^~/, homeVariable), which corrupts the path when the home directory contains these sequences. Switch each to a function replacement (() => homeVariable) so the home path is treated literally. Same fix as the core home-dir resolver (PR #122991) and terminal-core/display-string (#111398). Affected: voice-call utils + doctor, browser config, migrate-claude, migrate-hermes, memory-lancedb doctor, memory-host-sdk config-utils. * fix: cover iMessage and 1Password tilde expansion owners Address review: iMessage CLI path expansion and both 1Password state-path expansions (OPENCLAW_HOME and OPENCLAW_STATE_DIR) also passed resolved home as a string replacement. Apply the callback form so a literal-dollar home path is preserved. * test(voice-call): add literal-dollar tilde expansion regression Address review rank-up: mock os.homedir to a literal-dollar path and assert the resolved path preserves dollar-amp verbatim (fails on the string replacement form, passes with the callback). * test(extensions): cover literal-dollar tilde expansion at every changed owner * test(onepassword): cover tilde OPENCLAW_HOME literal-dollar expansion