Ayuriel/openclaw
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge 335b9cec53ff292207a02f3075a2a53de2959580 into 5e417b44e1540f528d2ae63e3e20229a902d1db2

Browse Source
This commit is contained in:
MOmo 2026-03-20 19:38:48 -07:00 committed by GitHub
commit 8b4048558d
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/security/audit-extra.sync.ts
View File

@ -1026,7 +1026,7 @@ export function collectNodeDenyCommandPatternFindings(cfg: OpenClawConfig): Secu
severity: "warn",
title: "Some gateway.nodes.denyCommands entries are ineffective",
detail:
"gateway.nodes.denyCommands uses exact node command-name matching only (for example `system.run`), not shell-text filtering inside a command payload.\n" +
"gateway.nodes.denyCommands uses exact node command-name matching only (for example `system.run`), not shell-text filtering inside a command payload. Typos and pattern-like entries silently fail open, so commands you expected to block may still run.\n" +
detailParts.map((entry) => `- ${entry}`).join("\n"),
remediation:
`Use exact command names (for example: ${examples.join(", ")}). ` +
@ -1304,7 +1304,7 @@ export function collectExposureMatrixFindings(cfg: OpenClawConfig): SecurityAudi
title: "Open groupPolicy with elevated tools enabled",
detail:
`Found groupPolicy="open" at:\n${openGroups.map((p) => `- ${p}`).join("\n")}\n` +
"With tools.elevated enabled, a prompt injection in those rooms can become a high-impact incident.",
"With tools.elevated enabled, a prompt injection in those rooms can become a high-impact incident. Mention gates reduce noise, but they are not a trust boundary.",
remediation: `Set groupPolicy="allowlist" and keep elevated allowlists extremely tight.`,
});
}