github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-04-26 09:08:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(config): sanitize validation log output to prevent control character injection (#39116)

Browse Source 
Co-authored-by: Bill <gsamzn@gmail.com>
This commit is contained in:
Peter Steinberger
2026-03-07 19:41:59 +00:00
parent 0e4603ac71
commit 4c2cb73055
2 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@@ -262,6 +262,7 @@ Docs: https://docs.openclaw.ai
- Models/provider apiKey persistence hardening: when a provider `apiKey` value equals a known provider env var value, persist the canonical env var name into `models.json` instead of resolved plaintext secrets. (#38889) Thanks @gambletan. - Models/provider apiKey persistence hardening: when a provider `apiKey` value equals a known provider env var value, persist the canonical env var name into `models.json` instead of resolved plaintext secrets. (#38889) Thanks @gambletan.
- Discord/model picker persistence check: add a short post-dispatch settle delay before reading back session model state so picker confirmations stop reporting false mismatch warnings after successful model switches. (#39105) Thanks @akropp. - Discord/model picker persistence check: add a short post-dispatch settle delay before reading back session model state so picker confirmations stop reporting false mismatch warnings after successful model switches. (#39105) Thanks @akropp.
- Agents/OpenAI WS compat store flag: omit `store` from `response.create` payloads when model compat sets `supportsStore: false`, preventing strict OpenAI-compatible providers from rejecting websocket requests with unknown-field errors. (#39113) Thanks @scoootscooob. - Agents/OpenAI WS compat store flag: omit `store` from `response.create` payloads when model compat sets `supportsStore: false`, preventing strict OpenAI-compatible providers from rejecting websocket requests with unknown-field errors. (#39113) Thanks @scoootscooob.
- Config/validation log sanitization: sanitize config-validation issue paths/messages before logging so control characters and ANSI escape sequences cannot inject misleading terminal output from crafted config content. (#39116) Thanks @powermaster888.
## 2026.3.2 ## 2026.3.2

11
src/config/io.ts
View File

@@ -13,6 +13,7 @@ import {
shouldDeferShellEnvFallback, shouldDeferShellEnvFallback,
shouldEnableShellEnvFallback, shouldEnableShellEnvFallback,
} from "../infra/shell-env.js"; } from "../infra/shell-env.js";
import { sanitizeTerminalText } from "../terminal/safe-text.js";
import { VERSION } from "../version.js"; import { VERSION } from "../version.js";
import { DuplicateAgentDirError, findDuplicateAgentDirs } from "./agent-dirs.js"; import { DuplicateAgentDirError, findDuplicateAgentDirs } from "./agent-dirs.js";
import { maintainConfigBackups } from "./backup-rotation.js"; import { maintainConfigBackups } from "./backup-rotation.js";
@@ -714,7 +715,10 @@ export function createConfigIO(overrides: ConfigIoDeps = {}) {
const validated = validateConfigObjectWithPlugins(resolvedConfig); const validated = validateConfigObjectWithPlugins(resolvedConfig);
if (!validated.ok) { if (!validated.ok) {
const details = validated.issues const details = validated.issues
.map((iss) => `- ${iss.path || "<root>"}: ${iss.message}`) .map(
(iss) =>
`- ${sanitizeTerminalText(iss.path || "<root>")}: ${sanitizeTerminalText(iss.message)}`,
)
.join("\n"); .join("\n");
if (!loggedInvalidConfigs.has(configPath)) { if (!loggedInvalidConfigs.has(configPath)) {
loggedInvalidConfigs.add(configPath); loggedInvalidConfigs.add(configPath);
@@ -727,7 +731,10 @@ export function createConfigIO(overrides: ConfigIoDeps = {}) {
} }
if (validated.warnings.length > 0) { if (validated.warnings.length > 0) {
const details = validated.warnings const details = validated.warnings
.map((iss) => `- ${iss.path || "<root>"}: ${iss.message}`) .map(
(iss) =>
`- ${sanitizeTerminalText(iss.path || "<root>")}: ${sanitizeTerminalText(iss.message)}`,
)
.join("\n"); .join("\n");
deps.logger.warn(`Config warnings:\\n${details}`); deps.logger.warn(`Config warnings:\\n${details}`);
} }