dilim/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-09 03:22:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(package): scope trusted URL auth to original origin

Browse Source
This commit is contained in:
Vincent Koc
2026-06-20 19:50:09 +02:00
parent 141fb2b119
commit b0df6dc10e
2 changed files with 56 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
scripts/resolve-openclaw-package-candidate.mjs
View File

@@ -963,10 +963,13 @@ function validateTrustedPackageDownloadUrl(parsed, trustedSource, options = {})
}
}
function createTrustedPackageAuthHeaders(trustedSource) {
function createTrustedPackageAuthHeaders(trustedSource, parsed, initialOrigin) {
if (!trustedSource?.auth) {
return undefined;
}
if (parsed.origin !== initialOrigin) {
return undefined;
}
const token = process.env[TRUSTED_PACKAGE_SOURCE_TOKEN_ENV];
if (!token) {
throw new Error(
@@ -1193,8 +1196,8 @@ async function openPackageDownloadResponse(url, options) {
const timeoutMs = options.timeoutMs ?? PACKAGE_URL_DOWNLOAD_TIMEOUT_MS;
const maxRedirects = options.maxRedirects ?? PACKAGE_URL_MAX_REDIRECTS;
const trustedSource = options.trustedSource;
const headers = createTrustedPackageAuthHeaders(trustedSource);
let parsed = new URL(url);
const initialOrigin = parsed.origin;
for (let redirectCount = 0; redirectCount <= maxRedirects; redirectCount += 1) {
if (trustedSource) {
validateTrustedPackageDownloadUrl(parsed, trustedSource, { isRedirect: redirectCount > 0 });
@@ -1202,6 +1205,7 @@ async function openPackageDownloadResponse(url, options) {
validatePackageDownloadUrl(parsed);
}
const addresses = await resolvePackageDownloadAddresses(parsed, lookupHost, trustedSource);
const headers = createTrustedPackageAuthHeaders(trustedSource, parsed, initialOrigin);
const opened = options.fetchImpl
? await openFetchPackageDownloadResponse(parsed, {
fetchImpl: options.fetchImpl,