fix(security): classify dangerous Windows sandbox binds f...
luoyanglang
·
2026-05-14
·
via Recent Commits to openclaw:main
| Original file line number | Diff line number | Diff line change |
|---|
@@ -68,6 +68,16 @@ describe("getBlockedBindReason", () => {
|
68 | 68 | expect(reason?.blockedPath).toBe("/home/tester/.gnupg"); |
69 | 69 | }); |
70 | 70 | |
| 71 | +it("blocks Windows USERPROFILE credential paths when HOME points elsewhere", () => { |
| 72 | +vi.stubEnv("HOME", "D:\\Users\\shell-home"); |
| 73 | +vi.stubEnv("USERPROFILE", "C:\\Users\\tester"); |
| 74 | + |
| 75 | +const reason = expectBlockedTargetReason( |
| 76 | +"C:\\Users\\tester\\.docker\\config.json:/mnt/docker:ro", |
| 77 | +); |
| 78 | +expect(reason?.blockedPath).toBe("C:/Users/tester/.docker"); |
| 79 | +}); |
| 80 | + |
71 | 81 | it("blocks canonical OS-home aliases for credential paths", () => { |
72 | 82 | if (process.platform === "win32") { |
73 | 83 | return; |
|
| Original file line number | Diff line number | Diff line change |
|---|
@@ -159,6 +159,7 @@ function getBlockedHostPaths(): string[] {
|
159 | 159 | home: process.env.HOME, |
160 | 160 | openclawHome: process.env.OPENCLAW_HOME, |
161 | 161 | osHome: os.homedir(), |
| 162 | +userProfile: process.env.USERPROFILE, |
162 | 163 | }); |
163 | 164 | if (blockedHostPathsCache?.key === cacheKey) { |
164 | 165 | return blockedHostPathsCache.paths; |
@@ -176,9 +177,15 @@ function getBlockedHostPaths(): string[] {
|
176 | 177 | function getBlockedHomeRoots(): string[] { |
177 | 178 | const roots = new Set<string>(); |
178 | 179 | for (const candidate of [ |
| 180 | +process.env.OPENCLAW_HOME, |
| 181 | +process.env.HOME, |
| 182 | +process.env.USERPROFILE, |
179 | 183 | resolveRequiredHomeDir(process.env, os.homedir), |
180 | 184 | resolveRequiredOsHomeDir(process.env, os.homedir), |
181 | 185 | ]) { |
| 186 | +if (!candidate) { |
| 187 | +continue; |
| 188 | +} |
182 | 189 | const normalized = normalizeHostPath(candidate); |
183 | 190 | if (normalized !== "/") { |
184 | 191 | roots.add(normalized); |
|
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。
