github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-08 22:28:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(security): tighten sandbox bind validation

Browse Source
This commit is contained in:
Peter Steinberger
2026-02-16 03:19:38 +01:00
parent a74251d415
commit a7cbce1b3d
4 changed files with 54 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
src/agents/sandbox/validate-sandbox-security.test.ts
View File

@@ -3,7 +3,7 @@ import { tmpdir } from "node:os";
import { join } from "node:path";
import { describe, expect, it } from "vitest";
import {
getBlockedBindReasonStringOnly,
getBlockedBindReason,
validateBindMounts,
validateNetworkMode,
validateSeccompProfile,
@@ -11,18 +11,17 @@ import {
validateSandboxSecurity,
} from "./validate-sandbox-security.js";
describe("getBlockedBindReasonStringOnly", () => {
it("blocks ancestor mounts that would expose the Docker socket", () => {
expect(getBlockedBindReasonStringOnly("/run:/run")).toEqual(
expect.objectContaining({ kind: "covers" }),
);
expect(getBlockedBindReasonStringOnly("/var/run:/var/run:ro")).toEqual(
expect.objectContaining({ kind: "covers" }),
);
expect(getBlockedBindReasonStringOnly("/var:/var")).toEqual(
expect.objectContaining({ kind: "covers" }),
describe("getBlockedBindReason", () => {
it("blocks common Docker socket directories", () => {
expect(getBlockedBindReason("/run:/run")).toEqual(expect.objectContaining({ kind: "targets" }));
expect(getBlockedBindReason("/var/run:/var/run:ro")).toEqual(
expect.objectContaining({ kind: "targets" }),
);
});
it("does not block /var by default", () => {
expect(getBlockedBindReason("/var:/var")).toBeNull();
});
});
describe("validateBindMounts", () => {
@@ -62,7 +61,7 @@ describe("validateBindMounts", () => {
it("blocks parent mounts that would expose the Docker socket", () => {
expect(() => validateBindMounts(["/run:/run"])).toThrow(/blocked path/);
expect(() => validateBindMounts(["/var/run:/var/run"])).toThrow(/blocked path/);
expect(() => validateBindMounts(["/var:/var"])).toThrow(/blocked path/);
expect(() => validateBindMounts(["/var:/var"])).not.toThrow();
});
it("blocks paths with .. traversal to dangerous directories", () => {