fix: harden node-host shell payload mutability checks · openclaw/openclaw@75c551e
obviyus
·
2026-04-16
·
via Recent Commits to openclaw:main
| Original file line number | Diff line number | Diff line change |
|---|
@@ -865,6 +865,28 @@ describe("hardenApprovedExecutionPaths", () => {
|
865 | 865 | } |
866 | 866 | }); |
867 | 867 | |
| 868 | +it("keeps fail-closed behavior for owner-controlled read-only absolute binaries", () => { |
| 869 | +if (process.platform === "win32") { |
| 870 | +return; |
| 871 | +} |
| 872 | +const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-shell-owned-readonly-binding-")); |
| 873 | +const binaryPath = path.join(tmp, "tool"); |
| 874 | +try { |
| 875 | +fs.copyFileSync(resolveNativeBinaryFixturePath(), binaryPath); |
| 876 | +fs.chmodSync(binaryPath, 0o555); |
| 877 | +fs.chmodSync(tmp, 0o555); |
| 878 | +const prepared = buildSystemRunApprovalPlan({ |
| 879 | +command: ["/bin/sh", "-lc", binaryPath], |
| 880 | +rawCommand: binaryPath, |
| 881 | +cwd: tmp, |
| 882 | +}); |
| 883 | +expect(prepared).toEqual(DENIED_RUNTIME_APPROVAL); |
| 884 | +} finally { |
| 885 | +fs.chmodSync(tmp, 0o755); |
| 886 | +fs.rmSync(tmp, { recursive: true, force: true }); |
| 887 | +} |
| 888 | +}); |
| 889 | + |
868 | 890 | it("keeps fail-closed behavior for symlinked binaries with writable targets", () => { |
869 | 891 | if (process.platform === "win32") { |
870 | 892 | return; |
|
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。
