mirror of
https://github.com/openclaw/openclaw.git
synced 2026-08-12 21:53:00 -06:00
Peter Steinberger
eb9cac065f
* fix(security): unify secret-redaction and SSRF policy ownership Memory-host errors now redact through the canonical redactor (payment/card/CVV coverage included) via the existing core facade instead of a stale local pattern table; ACP error redaction is wired through a single barrel so the injected canonical redactor no longer depends on module load order, and the acp-core fallback table shrinks to the minimal standalone set (structured auth-header patterns proven load-bearing stay). The memory-host SsrFPolicy structural copy is deleted in favor of the canonical src/infra/net/ssrf.ts type re-exported through the network facade. * fix(build): keep memory-core doctor closure execa-free Import the canonical redactor directly from src/logging/redact.js instead of the openclaw-runtime-io facade (which reaches execa through the full runtime graph), and regenerate the plugin SDK API baseline for the intentional canonical-SsrFPolicy surface change. * fix(security): merge operator redact patterns with defaults in injected redactors ClawSweeper found that ACP injected the general redactor, where nonempty logging.redactPatterns replace the built-in provider-token patterns. Use the tool-payload redactor for ACP and memory-host error formatting so operator patterns extend defaults and redaction remains forced for these security boundaries.
41 lines
849 B
YAML
41 lines
849 B
YAML
name: openclaw-codeql-network-ssrf-boundary-critical-security
|
|
|
|
disable-default-queries: true
|
|
|
|
queries:
|
|
- uses: security-extended
|
|
|
|
query-filters:
|
|
- include:
|
|
precision:
|
|
- high
|
|
- very-high
|
|
tags contain: security
|
|
security-severity: /([7-9]|10)\.(\d)+/
|
|
|
|
paths:
|
|
- src/infra/net
|
|
- src/agents/tools/web-fetch.ts
|
|
- src/agents/tools/web-guarded-fetch.ts
|
|
- src/agents/tools/web-shared.ts
|
|
- src/plugin-sdk/ssrf-policy.ts
|
|
- src/web-fetch
|
|
- src/web/provider-runtime-shared.ts
|
|
- packages/net-policy/src
|
|
|
|
paths-ignore:
|
|
- "**/node_modules"
|
|
- "**/coverage"
|
|
- "**/*.generated.ts"
|
|
- "**/*.bundle.js"
|
|
- "**/*-runtime.js"
|
|
- "**/*.test.ts"
|
|
- "**/*.test.tsx"
|
|
- "**/*.e2e.test.ts"
|
|
- "**/*.e2e.test.tsx"
|
|
- "**/*test-support*"
|
|
- "**/*test-helper*"
|
|
- "**/*mock*"
|
|
- "**/*fixture*"
|
|
- "**/*bench*"
|