fix(security): block shell env allowlist bypass in system.run

src/infra/host-env-security-policy.json

@@ -11,6 +11,8 @@
     "BASH_ENV",
     "ENV",
     "SHELL",
+    "SHELLOPTS",
+    "PS4",
     "GCONV_PATH",
     "IFS",
     "SSLKEYLOGFILE"

src/infra/host-env-security.test.ts

@@ -1,9 +1,14 @@
+import { spawn } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
 import { describe, expect, it } from "vitest";
 import {
   isDangerousHostEnvOverrideVarName,
   isDangerousHostEnvVarName,
   normalizeEnvVarKey,
   sanitizeHostExecEnv,
+  sanitizeSystemRunEnvOverrides,
 } from "./host-env-security.js";
 
 describe("isDangerousHostEnvVarName", () => {
@@ -11,6 +16,8 @@ describe("isDangerousHostEnvVarName", () => {
     expect(isDangerousHostEnvVarName("BASH_ENV")).toBe(true);
     expect(isDangerousHostEnvVarName("bash_env")).toBe(true);
     expect(isDangerousHostEnvVarName("SHELL")).toBe(true);
+    expect(isDangerousHostEnvVarName("SHELLOPTS")).toBe(true);
+    expect(isDangerousHostEnvVarName("ps4")).toBe(true);
     expect(isDangerousHostEnvVarName("DYLD_INSERT_LIBRARIES")).toBe(true);
     expect(isDangerousHostEnvVarName("ld_preload")).toBe(true);
     expect(isDangerousHostEnvVarName("BASH_FUNC_echo%%")).toBe(true);
@@ -48,17 +55,37 @@ describe("sanitizeHostExecEnv", () => {
         HOME: "/tmp/evil-home",
         ZDOTDIR: "/tmp/evil-zdotdir",
         BASH_ENV: "/tmp/pwn.sh",
+        SHELLOPTS: "xtrace",
+        PS4: "$(touch /tmp/pwned)",
         SAFE: "ok",
       },
     });
 
     expect(env.PATH).toBe("/usr/bin:/bin");
     expect(env.BASH_ENV).toBeUndefined();
+    expect(env.SHELLOPTS).toBeUndefined();
+    expect(env.PS4).toBeUndefined();
     expect(env.SAFE).toBe("ok");
     expect(env.HOME).toBe("/tmp/trusted-home");
     expect(env.ZDOTDIR).toBe("/tmp/trusted-zdotdir");
   });
 
+  it("drops dangerous inherited shell trace keys", () => {
+    const env = sanitizeHostExecEnv({
+      baseEnv: {
+        PATH: "/usr/bin:/bin",
+        SHELLOPTS: "xtrace",
+        PS4: "$(touch /tmp/pwned)",
+        OK: "1",
+      },
+    });
+
+    expect(env.PATH).toBe("/usr/bin:/bin");
+    expect(env.OK).toBe("1");
+    expect(env.SHELLOPTS).toBeUndefined();
+    expect(env.PS4).toBeUndefined();
+  });
+
   it("drops non-portable env key names", () => {
     const env = sanitizeHostExecEnv({
       baseEnv: {
@@ -94,3 +121,72 @@ describe("normalizeEnvVarKey", () => {
     expect(normalizeEnvVarKey("   ")).toBeNull();
   });
 });
+
+describe("sanitizeSystemRunEnvOverrides", () => {
+  it("keeps overrides for non-shell commands", () => {
+    const overrides = sanitizeSystemRunEnvOverrides({
+      shellWrapper: false,
+      overrides: {
+        OPENCLAW_TEST: "1",
+        TOKEN: "abc",
+      },
+    });
+    expect(overrides).toEqual({
+      OPENCLAW_TEST: "1",
+      TOKEN: "abc",
+    });
+  });
+
+  it("drops non-allowlisted overrides for shell wrappers", () => {
+    const overrides = sanitizeSystemRunEnvOverrides({
+      shellWrapper: true,
+      overrides: {
+        OPENCLAW_TEST: "1",
+        TOKEN: "abc",
+        LANG: "C",
+        LC_ALL: "C",
+      },
+    });
+    expect(overrides).toEqual({
+      LANG: "C",
+      LC_ALL: "C",
+    });
+  });
+});
+
+describe("shell wrapper exploit regression", () => {
+  it("blocks SHELLOPTS/PS4 chain after sanitization", async () => {
+    const bashPath = "/bin/bash";
+    if (process.platform === "win32" || !fs.existsSync(bashPath)) {
+      return;
+    }
+    const marker = path.join(os.tmpdir(), `openclaw-ps4-marker-${process.pid}-${Date.now()}`);
+    try {
+      fs.unlinkSync(marker);
+    } catch {
+      // no-op
+    }
+
+    const filteredOverrides = sanitizeSystemRunEnvOverrides({
+      shellWrapper: true,
+      overrides: {
+        SHELLOPTS: "xtrace",
+        PS4: `$(touch ${marker})`,
+      },
+    });
+    const env = sanitizeHostExecEnv({
+      overrides: filteredOverrides,
+      baseEnv: {
+        PATH: process.env.PATH ?? "/usr/bin:/bin",
+      },
+    });
+
+    await new Promise<void>((resolve, reject) => {
+      const child = spawn(bashPath, ["-lc", "echo SAFE"], { env, stdio: "ignore" });
+      child.once("error", reject);
+      child.once("close", () => resolve());
+    });
+
+    expect(fs.existsSync(marker)).toBe(false);
+  });
+});

src/infra/host-env-security.ts

@@ -19,10 +19,23 @@ export const HOST_DANGEROUS_ENV_PREFIXES: readonly string[] = Object.freeze(
 export const HOST_DANGEROUS_OVERRIDE_ENV_KEY_VALUES: readonly string[] = Object.freeze(
   (HOST_ENV_SECURITY_POLICY.blockedOverrideKeys ?? []).map((key) => key.toUpperCase()),
 );
+export const HOST_SHELL_WRAPPER_ALLOWED_OVERRIDE_ENV_KEY_VALUES: readonly string[] = Object.freeze([
+  "TERM",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "LC_MESSAGES",
+  "COLORTERM",
+  "NO_COLOR",
+  "FORCE_COLOR",
+]);
 export const HOST_DANGEROUS_ENV_KEYS = new Set<string>(HOST_DANGEROUS_ENV_KEY_VALUES);
 export const HOST_DANGEROUS_OVERRIDE_ENV_KEYS = new Set<string>(
   HOST_DANGEROUS_OVERRIDE_ENV_KEY_VALUES,
 );
+export const HOST_SHELL_WRAPPER_ALLOWED_OVERRIDE_ENV_KEYS = new Set<string>(
+  HOST_SHELL_WRAPPER_ALLOWED_OVERRIDE_ENV_KEY_VALUES,
+);
 
 export function normalizeEnvVarKey(
   rawKey: string,
@@ -105,3 +118,31 @@ export function sanitizeHostExecEnv(params?: {
 
   return merged;
 }
+
+export function sanitizeSystemRunEnvOverrides(params?: {
+  overrides?: Record<string, string> | null;
+  shellWrapper?: boolean;
+}): Record<string, string> | undefined {
+  const overrides = params?.overrides ?? undefined;
+  if (!overrides) {
+    return undefined;
+  }
+  if (!params?.shellWrapper) {
+    return overrides;
+  }
+  const filtered: Record<string, string> = {};
+  for (const [rawKey, value] of Object.entries(overrides)) {
+    if (typeof value !== "string") {
+      continue;
+    }
+    const key = normalizeEnvVarKey(rawKey, { portable: true });
+    if (!key) {
+      continue;
+    }
+    if (!HOST_SHELL_WRAPPER_ALLOWED_OVERRIDE_ENV_KEYS.has(key.toUpperCase())) {
+      continue;
+    }
+    filtered[key] = value;
+  }
+  return Object.keys(filtered).length > 0 ? filtered : undefined;
+}