github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-09 11:07:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

Security audit: suggest valid gateway.nodes.denyCommands entries (#29713)

Browse Source 
Merged via squash.

Prepared head SHA: db23298f98
Co-authored-by: liquidhorizon88-bot <257047709+liquidhorizon88-bot@users.noreply.github.com>
Co-authored-by: grp06 <1573959+grp06@users.noreply.github.com>
Reviewed-by: @grp06
This commit is contained in:
liquidhorizon88-bot
2026-03-03 18:47:57 -05:00
committed by GitHub
parent e8cb0484ce
commit d95cf256e7
4 changed files with 123 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
src/security/audit.test.ts
View File

@@ -1156,6 +1156,45 @@ description: test skill
expect(finding?.severity).toBe("warn");
expect(finding?.detail).toContain("system.*");
expect(finding?.detail).toContain("system.runx");
expect(finding?.detail).toContain("did you mean");
expect(finding?.detail).toContain("system.run");
});
it("suggests prefix-matching commands for unknown denyCommands entries", async () => {
const cfg: OpenClawConfig = {
gateway: {
nodes: {
denyCommands: ["system.run.prep"],
},
},
};
const res = await audit(cfg);
const finding = res.findings.find(
(f) => f.checkId === "gateway.nodes.deny_commands_ineffective",
);
expect(finding?.severity).toBe("warn");
expect(finding?.detail).toContain("system.run.prep");
expect(finding?.detail).toContain("did you mean");
expect(finding?.detail).toContain("system.run.prepare");
});
it("keeps unknown denyCommands entries without suggestions when no close command exists", async () => {
const cfg: OpenClawConfig = {
gateway: {
nodes: {
denyCommands: ["zzzzzzzzzzzzzz"],
},
},
};
const res = await audit(cfg);
const finding = res.findings.find(
(f) => f.checkId === "gateway.nodes.deny_commands_ineffective",
);
expect(finding?.severity).toBe("warn");
expect(finding?.detail).toContain("zzzzzzzzzzzzzz");
expect(finding?.detail).not.toContain("did you mean");
});
it("scores dangerous gateway.nodes.allowCommands by exposure", async () => {