vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-03-12 07:20:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Unauthenticated Nostr profile API allows remote config tampering (#13719)

Browse Source 
* fix(an-07): apply security fix

Generated by staged fix workflow.

* fix(an-07): apply security fix

Generated by staged fix workflow.

* fix(an-07): satisfy lint in plugin auth regression test

Replace unsafe unknown-to-string coercion in the gateway plugin auth test helper with explicit string/null/JSON handling so pnpm check passes.
This commit is contained in:
Coy Geek
2026-02-12 05:55:22 -08:00
committed by GitHub
parent acb9cbb898
commit 647d929c9d
3 changed files with 219 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
ui/src/ui/app-channels.ts
View File

@@ -66,6 +66,27 @@ function buildNostrProfileUrl(accountId: string, suffix = ""): string {
return `/api/channels/nostr/${encodeURIComponent(accountId)}/profile${suffix}`;
}
function resolveGatewayHttpAuthHeader(host: OpenClawApp): string | null {
const deviceToken = host.hello?.auth?.deviceToken?.trim();
if (deviceToken) {
return `Bearer ${deviceToken}`;
}
const token = host.settings.token.trim();
if (token) {
return `Bearer ${token}`;
}
const password = host.password.trim();
if (password) {
return `Bearer ${password}`;
}
return null;
}
function buildGatewayHttpHeaders(host: OpenClawApp): Record<string, string> {
const authorization = resolveGatewayHttpAuthHeader(host);
return authorization ? { Authorization: authorization } : {};
}
export function handleNostrProfileEdit(
host: OpenClawApp,
accountId: string,
@@ -133,6 +154,7 @@ export async function handleNostrProfileSave(host: OpenClawApp) {
method: "PUT",
headers: {
"Content-Type": "application/json",
...buildGatewayHttpHeaders(host),
},
body: JSON.stringify(state.values),
});
@@ -203,6 +225,7 @@ export async function handleNostrProfileImport(host: OpenClawApp) {
method: "POST",
headers: {
"Content-Type": "application/json",
...buildGatewayHttpHeaders(host),
},
body: JSON.stringify({ autoMerge: true }),
});