mirror of
https://github.com/openclaw/openclaw.git
synced 2026-08-25 11:55:47 -06:00
acb0e8e88d
An IRC sender mask is nick!user@host where only host is server verified; nick and user (ident) are client supplied and spoofable. The allowlist identity classifier treated any entry containing "!" or "@" as a verified stable identity, so a host-less nick!user entry was classified stable and matched by the host-less nick!user subject candidate. With dangerouslyAllowNameMatching at its secure default (off), the mutable identifier policy only strips entries owned by a dangerous field, so the host-less entry was never stripped and a remote sender presenting the same nick and ident was admitted regardless of host. Require a verified @host component before an entry or subject is classified stable. Host-less nick and host-less nick!user are now both routed to a dangerous (mutable) field so they are gated by the same name-matching policy. The doctor mutable-allowlist detector now also flags host-less nick!user entries so operators who typed that undocumented shape get a warning. The documented full nick!user@host mask stays stable and unaffected.
32 lines
895 B
TypeScript
32 lines
895 B
TypeScript
// Irc tests cover doctor mutable allowlist warnings.
|
|
import { describe, expect, it } from "vitest";
|
|
import { collectIrcMutableAllowlistWarnings } from "./doctor.js";
|
|
|
|
describe("collectIrcMutableAllowlistWarnings", () => {
|
|
it("warns on a host-less nick!user allowlist entry", () => {
|
|
const warnings = collectIrcMutableAllowlistWarnings({
|
|
cfg: {
|
|
channels: {
|
|
irc: {
|
|
allowFrom: ["alice!ident"],
|
|
},
|
|
},
|
|
} as never,
|
|
});
|
|
expect(warnings).toContain("- channels.irc.allowFrom: alice!ident");
|
|
});
|
|
|
|
it("does not warn on a full nick!user@host allowlist entry", () => {
|
|
const warnings = collectIrcMutableAllowlistWarnings({
|
|
cfg: {
|
|
channels: {
|
|
irc: {
|
|
allowFrom: ["alice!ident@example.com"],
|
|
},
|
|
},
|
|
} as never,
|
|
});
|
|
expect(warnings).toStrictEqual([]);
|
|
});
|
|
});
|