vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-04-04 13:51:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(exec): block proxy-style env overrides (#58202)

Browse Source 
* fix(exec): block proxy-style env overrides

* fix(exec): keep trusted host proxy env inherited

* fix(exec): block git tls override env vars

* fix(skills): block dangerous env override keys
This commit is contained in:
Vincent Koc
2026-03-31 21:25:36 +09:00
committed by GitHub
parent 28bb8c600e
commit 4d912e0451
7 changed files with 187 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/agents/bash-tools.exec.path.test.ts
View File

@@ -228,6 +228,22 @@ describe("exec host env validation", () => {
).rejects.toThrow(/Security Violation: Environment variable 'LD_DEBUG' is forbidden/);
});
it("blocks proxy and TLS override env vars on host execution", async () => {
const tool = createExecTool({ host: "gateway", security: "full", ask: "off" });
await expect(
tool.execute("call1", {
command: "echo ok",
env: {
HTTPS_PROXY: "http://proxy.example.test:8080",
NODE_TLS_REJECT_UNAUTHORIZED: "0",
},
}),
).rejects.toThrow(
/Security Violation: blocked override keys: HTTPS_PROXY, NODE_TLS_REJECT_UNAUTHORIZED\./,
);
});
it("strips dangerous inherited env vars from host execution", async () => {
if (isWin) {
return;