vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-04 03:10:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Align external marker span mapping (#63885)

Browse Source 
* fix(markers): align external marker spans

* fix(browser): ssrfPolicy defaults fail-closed for unconfigured installs (GHSA-53vx-pmqw-863c)

* fix(browser): enforce strict default SSRF policy

* chore(changelog): add browser SSRF default + marker alignment entry

---------

Co-authored-by: Devin Robison <drobison@nvidia.com>
This commit is contained in:
Agustin Rivera
2026-04-10 11:35:20 -07:00
committed by GitHub
parent daeb74920d
commit 905f19230a
11 changed files with 97 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
extensions/browser/src/browser/config.test.ts
View File

@@ -307,11 +307,9 @@ describe("browser config", () => {
});
});
it("defaults browser SSRF policy to trusted-network mode", () => {
it("defaults browser SSRF policy to strict mode when unset", () => {
const resolved = resolveBrowserConfig({});
expect(resolved.ssrfPolicy).toEqual({
dangerouslyAllowPrivateNetwork: true,
});
expect(resolved.ssrfPolicy).toEqual({});
});
it("supports explicit strict mode by disabling private network access", () => {
@@ -323,6 +321,19 @@ describe("browser config", () => {
expect(resolved.ssrfPolicy).toEqual({});
});
it("keeps allowlist-only browser SSRF policy strict by default", () => {
const resolved = resolveBrowserConfig({
ssrfPolicy: {
allowedHostnames: ["example.com"],
hostnameAllowlist: ["*.example.com"],
},
} as unknown as BrowserConfig);
expect(resolved.ssrfPolicy).toEqual({
allowedHostnames: ["example.com"],
hostnameAllowlist: ["*.example.com"],
});
});
it("resolves existing-session profiles without cdpPort or cdpUrl", () => {
const resolved = resolveBrowserConfig({
profiles: {

12
extensions/browser/src/browser/config.ts
View File

@@ -119,9 +119,7 @@ function resolveCdpPortRangeStart(
const normalizeStringList = normalizeOptionalTrimmedStringList;
function resolveBrowserSsrFPolicy(cfg: BrowserConfig | undefined): SsrFPolicy | undefined {
const rawPolicy = cfg?.ssrfPolicy as
| (BrowserConfig["ssrfPolicy"] & { allowPrivateNetwork?: boolean })
| undefined;
const rawPolicy = cfg?.ssrfPolicy;
const allowPrivateNetwork = rawPolicy?.allowPrivateNetwork;
const dangerouslyAllowPrivateNetwork = rawPolicy?.dangerouslyAllowPrivateNetwork;
const allowedHostnames = normalizeStringList(rawPolicy?.allowedHostnames);
@@ -129,9 +127,7 @@ function resolveBrowserSsrFPolicy(cfg: BrowserConfig | undefined): SsrFPolicy |
const hasExplicitPrivateSetting =
allowPrivateNetwork !== undefined || dangerouslyAllowPrivateNetwork !== undefined;
const resolvedAllowPrivateNetwork =
dangerouslyAllowPrivateNetwork === true ||
allowPrivateNetwork === true ||
!hasExplicitPrivateSetting;
dangerouslyAllowPrivateNetwork === true || allowPrivateNetwork === true;
if (
!resolvedAllowPrivateNetwork &&
@@ -139,7 +135,9 @@ function resolveBrowserSsrFPolicy(cfg: BrowserConfig | undefined): SsrFPolicy |
!allowedHostnames &&
!hostnameAllowlist
) {
return undefined;
// Keep the default policy object present so CDP guards still enforce
// fail-closed private-network checks on unconfigured installs.
return {};
}
return {