github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-09 08:57:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(gateway): serve Control UI bootstrap config and lock down CSP

Browse Source
This commit is contained in:
Peter Steinberger
2026-02-16 03:04:47 +01:00
parent 568fd337be
commit adc818db4a
2 changed files with 113 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files

63
src/gateway/gateway-misc.test.ts
View File

@@ -80,7 +80,68 @@ describe("handleControlUiHttpRequest", () => {
);
expect(handled).toBe(true);
expect(setHeader).toHaveBeenCalledWith("X-Frame-Options", "DENY");
expect(setHeader).toHaveBeenCalledWith("Content-Security-Policy", "frame-ancestors 'none'");
const csp = setHeader.mock.calls.find((call) => call[0] === "Content-Security-Policy")?.[1];
expect(typeof csp).toBe("string");
expect(String(csp)).toContain("frame-ancestors 'none'");
expect(String(csp)).toContain("script-src 'self'");
expect(String(csp)).not.toContain("script-src 'self' 'unsafe-inline'");
} finally {
await fs.rm(tmp, { recursive: true, force: true });
}
});
it("does not inject inline scripts into index.html", async () => {
const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-ui-"));
try {
const html = "<html><head></head><body>Hello</body></html>\n";
await fs.writeFile(path.join(tmp, "index.html"), html);
const { res, end } = makeControlUiResponse();
const handled = handleControlUiHttpRequest(
{ url: "/", method: "GET" } as IncomingMessage,
res,
{
root: { kind: "resolved", path: tmp },
config: {
agents: { defaults: { workspace: tmp } },
ui: { assistant: { name: "</script><script>alert(1)//", avatar: "evil.png" } },
},
},
);
expect(handled).toBe(true);
expect(end).toHaveBeenCalledWith(html);
} finally {
await fs.rm(tmp, { recursive: true, force: true });
}
});
it("serves bootstrap config JSON", async () => {
const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-ui-"));
try {
await fs.writeFile(path.join(tmp, "index.html"), "<html></html>\n");
const { res, end } = makeControlUiResponse();
const handled = handleControlUiHttpRequest(
{ url: "/__openclaw/control-ui-config.json", method: "GET" } as IncomingMessage,
res,
{
root: { kind: "resolved", path: tmp },
config: {
agents: { defaults: { workspace: tmp } },
ui: { assistant: { name: "</script><script>alert(1)//", avatar: "</script>.png" } },
},
},
);
expect(handled).toBe(true);
const payload = String(end.mock.calls[0]?.[0] ?? "");
const parsed = JSON.parse(payload) as {
basePath: string;
assistantName: string;
assistantAvatar: string;
assistantAgentId: string;
};
expect(parsed.basePath).toBe("");
expect(parsed.assistantName).toBe("</script><script>alert(1)//");
expect(parsed.assistantAvatar).toBe("/avatar/main");
expect(parsed.assistantAgentId).toBe("main");
} finally {
await fs.rm(tmp, { recursive: true, force: true });
}