vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-03-30 03:11:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(cr-mbx-feishu-encryptkey-config-redaction-bypass): apply security fix (#53414)

Browse Source 
Generated by staged fix workflow.
This commit is contained in:
Coy Geek
2026-03-26 16:58:37 -07:00
committed by GitHub
parent afc649255c
commit 8e285d112d
4 changed files with 41 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
src/plugin-sdk/secret-input-schema.ts
View File

@@ -1,5 +1,6 @@
import { z } from "zod";
import { ENV_SECRET_REF_ID_RE } from "../config/types.secrets.js";
import { sensitive } from "../config/zod-schema.sensitive.js";
import {
formatExecSecretRefIdValidationMessage,
isValidExecSecretRefId,
@@ -7,16 +8,17 @@ import {
SECRET_PROVIDER_ALIAS_PATTERN,
} from "../secrets/ref-contract.js";
/** Build the shared zod schema for secret inputs accepted by plugin auth/config surfaces. */
export function buildSecretInputSchema() {
const providerSchema = z
.string()
.regex(
SECRET_PROVIDER_ALIAS_PATTERN,
'Secret reference provider must match /^[a-z][a-z0-9_-]{0,63}$/ (example: "default").',
);
const providerSchema = z
.string()
.regex(
SECRET_PROVIDER_ALIAS_PATTERN,
'Secret reference provider must match /^[a-z][a-z0-9_-]{0,63}$/ (example: "default").',
);
return z.union([
// Singleton registered with the sensitive registry so that mapSensitivePaths
// marks every config field using this schema as sensitive (redacted).
const secretInputSchema = z
.union([
z.string(),
z.discriminatedUnion("source", [
z.object({
@@ -45,5 +47,10 @@ export function buildSecretInputSchema() {
id: z.string().refine(isValidExecSecretRefId, formatExecSecretRefIdValidationMessage()),
}),
]),
]);
])
.register(sensitive);
/** Build the shared zod schema for secret inputs accepted by plugin auth/config surfaces. */
export function buildSecretInputSchema() {
return secretInputSchema;
}