github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-10 00:13:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): harden account-key handling against prototype pollution

Browse Source
This commit is contained in:
Peter Steinberger
2026-02-24 01:09:23 +00:00
parent 12cc754332
commit f97c0922e1
24 changed files with 141 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/channels/plugins/config-writes.ts
View File

@@ -1,4 +1,5 @@
import type { OpenClawConfig } from "../../config/config.js";
import { resolveAccountEntry } from "../../routing/account-lookup.js";
import { normalizeAccountId } from "../../routing/session-key.js";
import type { ChannelId } from "./types.js";
@@ -8,16 +9,7 @@ type ChannelConfigWithAccounts = {
};
function resolveAccountConfig(accounts: ChannelConfigWithAccounts["accounts"], accountId: string) {
if (!accounts || typeof accounts !== "object") {
return undefined;
}
if (accountId in accounts) {
return accounts[accountId];
}
const matchKey = Object.keys(accounts).find(
(key) => key.toLowerCase() === accountId.toLowerCase(),
);
return matchKey ? accounts[matchKey] : undefined;
return resolveAccountEntry(accounts, accountId);
}
export function resolveChannelConfigWrites(params: {