github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-08 11:11:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): harden safeBins long-option validation

Browse Source
This commit is contained in:
Peter Steinberger
2026-02-23 23:55:28 +00:00
parent 7b4d2cb5cb
commit 3b8e33037a
4 changed files with 136 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
src/infra/exec-safe-bin-policy.test.ts
View File

@@ -48,12 +48,32 @@ describe("exec safe bin policy sort", () => {
it("allows stdin-only sort flags", () => {
expect(validateSafeBinArgv(["-S", "1M"], sortProfile)).toBe(true);
expect(validateSafeBinArgv(["--key=1,1"], sortProfile)).toBe(true);
expect(validateSafeBinArgv(["--ke=1,1"], sortProfile)).toBe(true);
});
it("blocks sort --compress-program in safe-bin mode", () => {
expect(validateSafeBinArgv(["--compress-program=sh"], sortProfile)).toBe(false);
expect(validateSafeBinArgv(["--compress-program", "sh"], sortProfile)).toBe(false);
});
it("blocks denied long-option abbreviations in safe-bin mode", () => {
expect(validateSafeBinArgv(["--compress-prog=sh"], sortProfile)).toBe(false);
expect(validateSafeBinArgv(["--files0-fro=list.txt"], sortProfile)).toBe(false);
});
it("rejects unknown or ambiguous long options in safe-bin mode", () => {
expect(validateSafeBinArgv(["--totally-unknown=1"], sortProfile)).toBe(false);
expect(validateSafeBinArgv(["--f=1"], sortProfile)).toBe(false);
});
});
describe("exec safe bin policy wc", () => {
const wcProfile = SAFE_BIN_PROFILES.wc;
it("blocks wc --files0-from abbreviations in safe-bin mode", () => {
expect(validateSafeBinArgv(["--files0-fro=list.txt"], wcProfile)).toBe(false);
expect(validateSafeBinArgv(["--files0-fro", "list.txt"], wcProfile)).toBe(false);
});
});
describe("exec safe bin policy denied-flag matrix", () => {