vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-07-21 16:01:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): classify proxied APNs TLS tunnel (#110480)

Browse Source 
* fix(ci): classify proxied APNs TLS tunnel

* fix(ci): prove network CodeQL contract changes

Co-authored-by: zhang-guiping <zhang.guiping@xydigit.com>

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
This commit is contained in:
xingzhou
2026-07-18 23:18:29 +08:00
committed by GitHub
parent 63a32e360b
commit faf3dbdda8
3 changed files with 13 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
.github/codeql/openclaw-boundary/queries/raw-socket-callsite-classification.ql vendored
View File

@@ -62,13 +62,10 @@ predicate allowedRawSocketClientCall(Expr call) {
or
allowedOwnerScope(call, "src/infra/ssh-tunnel.ts", "canConnectLocal")
or
allowedOwnerScope(call, "src/infra/gateway-lock.ts", "checkPortFree")
or
allowedOwnerScope(call, "src/infra/jsonl-socket.ts", "requestJsonlSocketWithMaxLineBytes")
or
allowedOwnerScope(call, "src/infra/net/http-connect-tunnel.ts", "connectToProxy")
or
allowedOwnerScope(call, "src/infra/net/http-connect-tunnel.ts", "startTargetTls")
// This TLS layer wraps the managed CONNECT socket; it cannot open a direct route.
allowedOwnerScope(call, "src/infra/push-apns-http2.ts", "openApnsTlsTunnel")
or
allowedOwnerScope(call, "src/infra/push-apns-http2.ts", "openProxiedApnsHttp2Session")
or

9
.github/workflows/codeql-critical-quality.yml vendored
View File

@@ -447,6 +447,7 @@ jobs:
added_lines="$(mktemp)"
raw_socket_scan_lines="$(mktemp)"
codex_transport="extensions/codex/src/app-server/transport-websocket.ts"
network_codeql_contract_pattern='^\.github/codeql/(codeql-network-runtime-boundary-critical-quality\.yml|openclaw-boundary/queries/(raw-socket-callsite-classification|managed-proxy-runtime-mutation)\.ql)$'
gh api --paginate "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files" --jq '.[].filename' > "$changed_files"
gh api --paginate "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files" --jq '
@@ -472,10 +473,10 @@ jobs:
| "\($file): \(.)"
' > "$raw_socket_scan_lines"
if grep -Fxq "$codex_transport" "$changed_files"; then
# This transport has an exact owner/function allowlist in the raw-socket
# CodeQL query, so its raw socket calls run there. Proxy policy tokens
# remain in the fast scan below.
# Query/config edits need semantic analysis; the fast diff scan cannot validate QL.
# The Codex transport also has an exact owner/function allowlist in the query.
if grep -Eq "$network_codeql_contract_pattern" "$changed_files" || \
grep -Fxq "$codex_transport" "$changed_files"; then
echo "full_codeql=true" >> "$GITHUB_OUTPUT"
else
echo "full_codeql=false" >> "$GITHUB_OUTPUT"

6
test/scripts/ci-workflow-guards.test.ts
View File

@@ -4998,6 +4998,12 @@ printf '%s\n' "\${CURL_SUCCESS_IP:-203.0.113.7}"
expect(workflow).toContain(
'codex_transport="extensions/codex/src/app-server/transport-websocket.ts"',
);
expect(workflow).toContain(
"network_codeql_contract_pattern='^\\.github/codeql/(codeql-network-runtime-boundary-critical-quality\\.yml|openclaw-boundary/queries/(raw-socket-callsite-classification|managed-proxy-runtime-mutation)\\.ql)$'",
);
expect(workflow).toContain(
'if grep -Eq "$network_codeql_contract_pattern" "$changed_files" ||',
);
expect(workflow).toContain(
'| select(.filename != "extensions/codex/src/app-server/transport-websocket.ts")',
);