dilim/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-08 02:52:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(e2e): reject escaped skill info paths

Browse Source
This commit is contained in:
Vincent Koc
2026-06-20 08:31:42 +02:00
parent 075965e32f
commit 7b44157bc6
2 changed files with 73 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
scripts/e2e/lib/skills/clawhub-install-proof.sh
View File

@@ -125,6 +125,10 @@ import fs from "node:fs";
import path from "node:path";
const [configPath, skillDir, originPath, lockPath, infoPath, slug] = process.argv.slice(2);
const read = (file) => JSON.parse(fs.readFileSync(file, "utf8"));
function isPathInside(parentPath, childPath) {
const relative = path.relative(path.resolve(parentPath), path.resolve(childPath));
return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
}
const config = read(configPath);
if (config.skills?.install?.allowUploadedArchives !== false) {
throw new Error("skills.install.allowUploadedArchives must remain false during ClawHub install proof");
@@ -142,7 +146,7 @@ const infoFilePath = info.filePath ?? info.skill?.filePath;
const infoBaseDir = info.baseDir ?? info.skill?.baseDir;
if (
info.skillKey !== slug &&
(!infoFilePath || !path.resolve(infoFilePath).startsWith(path.resolve(skillDir)))
(!infoFilePath || !isPathInside(skillDir, infoFilePath))
) {
throw new Error(`skills info did not report installed skill ${slug}: ${JSON.stringify(info)}`);
}