Files
openclaw/extensions/irc/src/doctor.test.ts
Yuval Dinodia acb0e8e88d fix(irc): classify host-less nick!user allowlist entries as mutable
An IRC sender mask is nick!user@host where only host is server verified;
nick and user (ident) are client supplied and spoofable. The allowlist
identity classifier treated any entry containing "!" or "@" as a verified
stable identity, so a host-less nick!user entry was classified stable and
matched by the host-less nick!user subject candidate. With
dangerouslyAllowNameMatching at its secure default (off), the mutable
identifier policy only strips entries owned by a dangerous field, so the
host-less entry was never stripped and a remote sender presenting the same
nick and ident was admitted regardless of host.

Require a verified @host component before an entry or subject is classified
stable. Host-less nick and host-less nick!user are now both routed to a
dangerous (mutable) field so they are gated by the same name-matching policy.
The doctor mutable-allowlist detector now also flags host-less nick!user
entries so operators who typed that undocumented shape get a warning. The
documented full nick!user@host mask stays stable and unaffected.
2026-07-01 04:01:05 -07:00

32 lines
895 B
TypeScript

// Irc tests cover doctor mutable allowlist warnings.
import { describe, expect, it } from "vitest";
import { collectIrcMutableAllowlistWarnings } from "./doctor.js";
describe("collectIrcMutableAllowlistWarnings", () => {
it("warns on a host-less nick!user allowlist entry", () => {
const warnings = collectIrcMutableAllowlistWarnings({
cfg: {
channels: {
irc: {
allowFrom: ["alice!ident"],
},
},
} as never,
});
expect(warnings).toContain("- channels.irc.allowFrom: alice!ident");
});
it("does not warn on a full nick!user@host allowlist entry", () => {
const warnings = collectIrcMutableAllowlistWarnings({
cfg: {
channels: {
irc: {
allowFrom: ["alice!ident@example.com"],
},
},
} as never,
});
expect(warnings).toStrictEqual([]);
});
});