github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-06-07 22:09:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(security): centralize host env policy and harden env ingestion

Browse Source
This commit is contained in:
Peter Steinberger
2026-02-21 13:04:34 +01:00
parent 08e020881d
commit f202e73077
10 changed files with 201 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
src/config/config.env-vars.test.ts
View File

@@ -3,7 +3,7 @@ import path from "node:path";
import { describe, expect, it } from "vitest";
import { loadDotEnv } from "../infra/dotenv.js";
import { resolveConfigEnvVars } from "./env-substitution.js";
import { applyConfigEnvVars, collectConfigEnvVars } from "./env-vars.js";
import { applyConfigEnvVars, collectConfigRuntimeEnvVars } from "./env-vars.js";
import { withEnvOverride, withTempHome } from "./test-helpers.js";
import type { OpenClawConfig } from "./types.js";
@@ -34,7 +34,7 @@ describe("config env vars", () => {
const config = {
env: { vars: { BASH_ENV: "/tmp/pwn.sh", OPENROUTER_API_KEY: "config-key" } },
};
const entries = collectConfigEnvVars(config as OpenClawConfig);
const entries = collectConfigRuntimeEnvVars(config as OpenClawConfig);
expect(entries.BASH_ENV).toBeUndefined();
expect(entries.OPENROUTER_API_KEY).toBe("config-key");
@@ -44,6 +44,24 @@ describe("config env vars", () => {
});
});
it("drops non-portable env keys from config env", async () => {
await withEnvOverride({ OPENROUTER_API_KEY: undefined }, async () => {
const config = {
env: {
vars: {
" BAD KEY": "oops",
OPENROUTER_API_KEY: "config-key",
},
"NOT-PORTABLE": "bad",
},
};
const entries = collectConfigRuntimeEnvVars(config as OpenClawConfig);
expect(entries.OPENROUTER_API_KEY).toBe("config-key");
expect(entries[" BAD KEY"]).toBeUndefined();
expect(entries["NOT-PORTABLE"]).toBeUndefined();
});
});
it("loads ${VAR} substitutions from ~/.openclaw/.env on repeated runtime loads", async () => {
await withTempHome(async (_home) => {
await withEnvOverride({ BRAVE_API_KEY: undefined }, async () => {

33
src/config/env-vars.ts
View File

@@ -1,7 +1,7 @@
import { isDangerousHostEnvVarName } from "../infra/host-env-security.js";
import { isDangerousHostEnvVarName, normalizeEnvVarKey } from "../infra/host-env-security.js";
import type { OpenClawConfig } from "./types.js";
export function collectConfigEnvVars(cfg?: OpenClawConfig): Record<string, string> {
function collectConfigEnvVarsByTarget(cfg?: OpenClawConfig): Record<string, string> {
const envConfig = cfg?.env;
if (!envConfig) {
return {};
@@ -10,10 +10,14 @@ export function collectConfigEnvVars(cfg?: OpenClawConfig): Record<string, strin
const entries: Record<string, string> = {};
if (envConfig.vars) {
for (const [key, value] of Object.entries(envConfig.vars)) {
for (const [rawKey, value] of Object.entries(envConfig.vars)) {
if (!value) {
continue;
}
const key = normalizeEnvVarKey(rawKey, { portable: true });
if (!key) {
continue;
}
if (isDangerousHostEnvVarName(key)) {
continue;
}
@@ -21,13 +25,17 @@ export function collectConfigEnvVars(cfg?: OpenClawConfig): Record<string, strin
}
}
for (const [key, value] of Object.entries(envConfig)) {
if (key === "shellEnv" || key === "vars") {
for (const [rawKey, value] of Object.entries(envConfig)) {
if (rawKey === "shellEnv" || rawKey === "vars") {
continue;
}
if (typeof value !== "string" || !value.trim()) {
continue;
}
const key = normalizeEnvVarKey(rawKey, { portable: true });
if (!key) {
continue;
}
if (isDangerousHostEnvVarName(key)) {
continue;
}
@@ -37,11 +45,24 @@ export function collectConfigEnvVars(cfg?: OpenClawConfig): Record<string, strin
return entries;
}
export function collectConfigRuntimeEnvVars(cfg?: OpenClawConfig): Record<string, string> {
return collectConfigEnvVarsByTarget(cfg);
}
export function collectConfigServiceEnvVars(cfg?: OpenClawConfig): Record<string, string> {
return collectConfigEnvVarsByTarget(cfg);
}
/** @deprecated Use `collectConfigRuntimeEnvVars` or `collectConfigServiceEnvVars`. */
export function collectConfigEnvVars(cfg?: OpenClawConfig): Record<string, string> {
return collectConfigRuntimeEnvVars(cfg);
}
export function applyConfigEnvVars(
cfg: OpenClawConfig,
env: NodeJS.ProcessEnv = process.env,
): void {
const entries = collectConfigEnvVars(cfg);
const entries = collectConfigRuntimeEnvVars(cfg);
for (const [key, value] of Object.entries(entries)) {
if (env[key]?.trim()) {
continue;