github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-08 16:38:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Security: harden sandboxed media handling (#9182)

Browse Source 
* Message: enforce sandbox for media param

* fix: harden sandboxed media handling (#8780) (thanks @victormier)

* chore: format message action runner (#8780) (thanks @victormier)

---------

Co-authored-by: Victor Mier <victormier@gmail.com>
This commit is contained in:
Gustavo Madeira Santana
2026-02-04 19:11:23 -05:00
committed by GitHub
parent 5e025c4ba3
commit 4434cae565
6 changed files with 278 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files

83
src/agents/tools/message-tool.test.ts
View File

@@ -1,6 +1,3 @@
import fs from "node:fs/promises";
import os from "node:os";
import path from "node:path";
import { describe, expect, it, vi } from "vitest";
import type { ChannelPlugin } from "../../channels/plugins/types.js";
import type { MessageActionRunResult } from "../../infra/outbound/message-action-runner.js";
@@ -165,50 +162,8 @@ describe("message tool description", () => {
});
});
describe("message tool sandbox path validation", () => {
it("rejects filePath that escapes sandbox root", async () => {
const sandboxDir = await fs.mkdtemp(path.join(os.tmpdir(), "msg-sandbox-"));
try {
const tool = createMessageTool({
config: {} as never,
sandboxRoot: sandboxDir,
});
await expect(
tool.execute("1", {
action: "send",
target: "telegram:123",
filePath: "/etc/passwd",
message: "",
}),
).rejects.toThrow(/sandbox/i);
} finally {
await fs.rm(sandboxDir, { recursive: true, force: true });
}
});
it("rejects path param with traversal sequence", async () => {
const sandboxDir = await fs.mkdtemp(path.join(os.tmpdir(), "msg-sandbox-"));
try {
const tool = createMessageTool({
config: {} as never,
sandboxRoot: sandboxDir,
});
await expect(
tool.execute("1", {
action: "send",
target: "telegram:123",
path: "../../../etc/shadow",
message: "",
}),
).rejects.toThrow(/sandbox/i);
} finally {
await fs.rm(sandboxDir, { recursive: true, force: true });
}
});
it("allows filePath inside sandbox root", async () => {
describe("message tool sandbox passthrough", () => {
it("forwards sandboxRoot to runMessageAction", async () => {
mocks.runMessageAction.mockClear();
mocks.runMessageAction.mockResolvedValue({
kind: "send",
@@ -220,27 +175,22 @@ describe("message tool sandbox path validation", () => {
dryRun: true,
} satisfies MessageActionRunResult);
const sandboxDir = await fs.mkdtemp(path.join(os.tmpdir(), "msg-sandbox-"));
try {
const tool = createMessageTool({
config: {} as never,
sandboxRoot: sandboxDir,
});
const tool = createMessageTool({
config: {} as never,
sandboxRoot: "/tmp/sandbox",
});
await tool.execute("1", {
action: "send",
target: "telegram:123",
filePath: "./data/file.txt",
message: "",
});
await tool.execute("1", {
action: "send",
target: "telegram:123",
message: "",
});
expect(mocks.runMessageAction).toHaveBeenCalledTimes(1);
} finally {
await fs.rm(sandboxDir, { recursive: true, force: true });
}
const call = mocks.runMessageAction.mock.calls[0]?.[0];
expect(call?.sandboxRoot).toBe("/tmp/sandbox");
});
it("skips validation when no sandboxRoot is set", async () => {
it("omits sandboxRoot when not configured", async () => {
mocks.runMessageAction.mockClear();
mocks.runMessageAction.mockResolvedValue({
kind: "send",
@@ -259,11 +209,10 @@ describe("message tool sandbox path validation", () => {
await tool.execute("1", {
action: "send",
target: "telegram:123",
filePath: "/etc/passwd",
message: "",
});
// Without sandboxRoot the validation is skipped — unsandboxed sessions work normally.
expect(mocks.runMessageAction).toHaveBeenCalledTimes(1);
const call = mocks.runMessageAction.mock.calls[0]?.[0];
expect(call?.sandboxRoot).toBeUndefined();
});
});