github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-09 19:44:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(configure): reject literal "undefined" and "null" gateway auth tokens (#13767)

Browse Source 
* fix(configure): reject literal "undefined" and "null" gateway auth tokens

* fix(configure): reject literal "undefined" and "null" gateway auth tokens

* fix(configure): validate gateway password prompt and harden token coercion (#13767) (thanks @omair445)

* test: remove unused vitest imports in baseline lint fixtures (#13767)

---------

Co-authored-by: Luna AI <luna@coredirection.ai>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
This commit is contained in:
Omair Afzal
2026-02-13 21:04:41 +05:00
committed by GitHub
parent 4dc93f40d5
commit 59733a02c8
9 changed files with 118 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
src/commands/configure.gateway-auth.ts
View File

@@ -16,6 +16,18 @@ import { randomToken } from "./onboard-helpers.js";
type GatewayAuthChoice = "token" | "password";
/** Reject undefined, empty, and common JS string-coercion artifacts for token auth. */
function sanitizeTokenValue(value: string | undefined): string | undefined {
if (typeof value !== "string") {
return undefined;
}
const trimmed = value.trim();
if (!trimmed || trimmed === "undefined" || trimmed === "null") {
return undefined;
}
return trimmed;
}
const ANTHROPIC_OAUTH_MODEL_KEYS = [
"anthropic/claude-opus-4-6",
"anthropic/claude-opus-4-5",
@@ -36,11 +48,12 @@ export function buildGatewayAuthConfig(params: {
}
if (params.mode === "token") {
// Guard against undefined/empty token to prevent JSON.stringify from writing the string "undefined"
const safeToken = params.token?.trim() || randomToken();
return { ...base, mode: "token", token: safeToken };
// Keep token mode always valid: treat empty/undefined/"undefined"/"null" as missing and generate a token.
const token = sanitizeTokenValue(params.token) ?? randomToken();
return { ...base, mode: "token", token };
}
return { ...base, mode: "password", password: params.password };
const password = params.password?.trim();
return { ...base, mode: "password", ...(password && { password }) };
}
export async function promptAuthConfig(