vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-04-29 18:12:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

Block reset-profile on lower-privilege browser request surfaces (#54618)

Browse Source 
* Block reset-profile on lower-privilege browser request surfaces

* add missing tests

* Fix tests

* Test fix
This commit is contained in:
Devin Robison
2026-03-25 12:36:59 -07:00
committed by GitHub
parent 4797bbc5b9
commit 1b3a1246d0
6 changed files with 84 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
src/node-host/invoke-browser.test.ts
View File

@@ -238,7 +238,7 @@ describe("runBrowserProxyCommand", () => {
}),
),
).rejects.toThrow(
"INVALID_REQUEST: browser.proxy cannot create or delete persistent browser profiles when allowProfiles is configured",
"INVALID_REQUEST: browser.proxy cannot mutate persistent browser profiles when allowProfiles is configured",
);
expect(dispatcherMocks.dispatch).not.toHaveBeenCalled();
});
@@ -258,7 +258,28 @@ describe("runBrowserProxyCommand", () => {
}),
),
).rejects.toThrow(
"INVALID_REQUEST: browser.proxy cannot create or delete persistent browser profiles when allowProfiles is configured",
"INVALID_REQUEST: browser.proxy cannot mutate persistent browser profiles when allowProfiles is configured",
);
expect(dispatcherMocks.dispatch).not.toHaveBeenCalled();
});
it("rejects persistent profile reset when allowProfiles is configured", async () => {
configMocks.loadConfig.mockReturnValue({
browser: {},
nodeHost: { browserProxy: { enabled: true, allowProfiles: ["openclaw"] } },
});
await expect(
runBrowserProxyCommand(
JSON.stringify({
method: "POST",
path: "/reset-profile",
body: { profile: "openclaw", name: "openclaw" },
timeoutMs: 50,
}),
),
).rejects.toThrow(
"INVALID_REQUEST: browser.proxy cannot mutate persistent browser profiles when allowProfiles is configured",
);
expect(dispatcherMocks.dispatch).not.toHaveBeenCalled();
});

2
src/node-host/invoke-browser.ts
View File

@@ -239,7 +239,7 @@ export async function runBrowserProxyCommand(paramsJSON?: string | null): Promis
if (allowedProfiles.length > 0) {
if (isPersistentBrowserProfileMutation(method, path)) {
throw new Error(
"INVALID_REQUEST: browser.proxy cannot create or delete persistent browser profiles when allowProfiles is configured",
"INVALID_REQUEST: browser.proxy cannot mutate persistent browser profiles when allowProfiles is configured",
);
}
if (path !== "/profiles") {