mirror of
https://github.com/openclaw/openclaw.git
synced 2026-08-02 19:41:34 +00:00
a1e0c9ea09
* test(channels): share DM policy contract suite * refactor(memory): remove dead host CLI routes * refactor(acp): use canonical normalization helpers * refactor(web): fold provider runtime into core * refactor(packages): remove dead runtime exports * chore(knip): drop retired ACP entry roots
42 lines
902 B
YAML
42 lines
902 B
YAML
name: openclaw-codeql-network-ssrf-boundary-critical-security
|
|
|
|
disable-default-queries: true
|
|
|
|
queries:
|
|
- uses: security-extended
|
|
|
|
query-filters:
|
|
- include:
|
|
precision:
|
|
- high
|
|
- very-high
|
|
tags contain: security
|
|
security-severity: /([7-9]|10)\.(\d)+/
|
|
|
|
paths:
|
|
- src/infra/net
|
|
- src/agents/tools/web-fetch.ts
|
|
- src/agents/tools/web-guarded-fetch.ts
|
|
- src/agents/tools/web-shared.ts
|
|
- src/plugin-sdk/ssrf-policy.ts
|
|
- src/web-fetch
|
|
- src/web/provider-runtime-shared.ts
|
|
- packages/memory-host-sdk/src/host/ssrf-policy.ts
|
|
- packages/net-policy/src
|
|
|
|
paths-ignore:
|
|
- "**/node_modules"
|
|
- "**/coverage"
|
|
- "**/*.generated.ts"
|
|
- "**/*.bundle.js"
|
|
- "**/*-runtime.js"
|
|
- "**/*.test.ts"
|
|
- "**/*.test.tsx"
|
|
- "**/*.e2e.test.ts"
|
|
- "**/*.e2e.test.tsx"
|
|
- "**/*test-support*"
|
|
- "**/*test-helper*"
|
|
- "**/*mock*"
|
|
- "**/*fixture*"
|
|
- "**/*bench*"
|