@@ -693,7 +693,7 @@ describe("resolve-openclaw-package-candidate", () => {
693693status: 200,
694694});
695695},
696-lookupHost: lookupAddresses([{ address: "10.0.0.8", family: 4 }]),
696+lookupHost: lookupAddresses([{ address: "203.0.113.8", family: 4 }]),
697697maxBytes: 3,
698698 trustedSource,
699699});
@@ -713,7 +713,44 @@ describe("resolve-openclaw-package-candidate", () => {
713713await expect(
714714downloadUrl("https://packages.internal:8443/other/openclaw.tgz", target, {
715715fetchImpl: unexpectedFetch,
716-lookupHost: lookupAddresses([{ address: "10.0.0.8", family: 4 }]),
716+lookupHost: lookupAddresses([{ address: "203.0.113.8", family: 4 }]),
717+ trustedSource,
718+}),
719+).rejects.toThrow("path is not allowed by trusted package source enterprise-artifactory");
720+});
721+722+it("matches trusted package_url path prefixes on path segment boundaries", async () => {
723+const dir = await mkdtemp(path.join(tmpdir(), "openclaw-package-download-"));
724+tempDirs.push(dir);
725+const target = path.join(dir, "openclaw.tgz");
726+const trustedSource = {
727+allowPrivateNetwork: true,
728+hosts: ["packages.internal"],
729+id: "enterprise-artifactory",
730+pathPrefixes: ["/artifactory/openclaw"],
731+ports: [8443],
732+redirectHosts: ["packages.internal"],
733+};
734+const requestedUrls: string[] = [];
735+736+await downloadUrl("https://packages.internal:8443/artifactory/openclaw/pkg.tgz", target, {
737+fetchImpl: async (url: URL) => {
738+requestedUrls.push(url.toString());
739+return new Response(new Uint8Array([1, 2, 3]), {
740+headers: { "content-length": "3" },
741+status: 200,
742+});
743+},
744+lookupHost: lookupAddresses([{ address: "203.0.113.8", family: 4 }]),
745+maxBytes: 3,
746+ trustedSource,
747+});
748+749+expect(requestedUrls).toEqual(["https://packages.internal:8443/artifactory/openclaw/pkg.tgz"]);
750+await expect(
751+downloadUrl("https://packages.internal:8443/artifactory/openclaw-malicious/pkg.tgz", target, {
752+fetchImpl: unexpectedFetch,
753+lookupHost: lookupAddresses([{ address: "203.0.113.8", family: 4 }]),
717754 trustedSource,
718755}),
719756).rejects.toThrow("path is not allowed by trusted package source enterprise-artifactory");
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。