github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-09 22:54:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(gateway)!: require explicit non-loopback control-ui origins

Browse Source
This commit is contained in:
Peter Steinberger
2026-02-24 01:52:15 +00:00
parent edfefdff7d
commit 223d7dc23d
19 changed files with 187 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
src/security/audit.test.ts
View File

@@ -1136,6 +1136,38 @@ describe("security audit", () => {
expect(finding?.detail).toContain("tools.exec.applyPatch.workspaceOnly=false");
});
it("flags non-loopback Control UI without allowed origins", async () => {
const cfg: OpenClawConfig = {
gateway: {
bind: "lan",
auth: { mode: "token", token: "very-long-browser-token-0123456789" },
},
};
const res = await audit(cfg);
expectFinding(res, "gateway.control_ui.allowed_origins_required", "critical");
});
it("flags dangerous host-header origin fallback and suppresses missing allowed-origins finding", async () => {
const cfg: OpenClawConfig = {
gateway: {
bind: "lan",
auth: { mode: "token", token: "very-long-browser-token-0123456789" },
controlUi: {
dangerouslyAllowHostHeaderOriginFallback: true,
},
},
};
const res = await audit(cfg);
expectFinding(res, "gateway.control_ui.host_header_origin_fallback", "critical");
expectNoFinding(res, "gateway.control_ui.allowed_origins_required");
const flags = res.findings.find((f) => f.checkId === "config.insecure_or_dangerous_flags");
expect(flags?.detail ?? "").toContain(
"gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback=true",
);
});
it("scores X-Real-IP fallback risk by gateway exposure", async () => {
const trustedProxyCfg = (trustedProxies: string[]): OpenClawConfig => ({
gateway: {