sami7777/dashcaddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(openclaw): harden proxy — 5 MiB cap, RFC 7230 hop-by-hop strip, open-redirect (Location/Refresh/WWW-Auth) strip, path + status validators (DC-065) [glm-grade=A]
CI / Test & Lint (push) Canceled after 0s
Details
CI / Security audit (push) Canceled after 0s
Details

Browse Source 
Round 1 GLM-5.3: C — missing "location" (open-redirect through proxy).
Round 2 GLM-5.3: C — missing "refresh" + "www-authenticate" (same class).
Round 3 GLM-5.3: A — ship.

Closure of four vulnerabilities in routes/openclaw.js proxyRequest():

  (a) Unbounded response passthrough → 5 MiB cap with 502 + DC-065
      message on overrun. Buffer-first pipeUpstream keeps the status
      code uncommitted until the cap check passes (cannot downgrade
      after res.write()).

  (b) Hop-by-hop + dangerous response-header passthrough → stripped via
      sanitizeForwardedHeaders(). Hop-by-hop per RFC 7230 §6.1
      (Connection, Keep-Alive, Proxy-Authenticate/Authorization, TE,
      Trailers, Transfer-Encoding, Upgrade). Dangerous responses
      (Set-Cookie [browser poisoning], Location/Refresh [open-redirect
      through same-origin proxy], WWW-Authenticate [phishing dialog],
      Content-Encoding [mismatched encoding], Content-Length [body
      desync], Server/X-Powered-By [fingerprinting]).

  (c) proxyRes.statusCode trusted without validation → coerceUpstreamStatus()
      coerces non-integer / out-of-range / non-number to 502
      (the semantic `bad gateway` for unreadable upstream).

  (d) Path taken from req.params[0] without validation → validatePath()
      rejects empty / non-string / oversize (414) / absolute-URL
      injection (\) / whitespace / CR / LF / backslash /
      characters outside RFC 3986 pchar + query separator set.

Tests: __tests__/routes/openclaw.proxy-hardening.test.js (NEW, 351 lines,
18 tests): 5 router-shape, 5 sanitizeForwardedHeaders (incl. all
stripped-header classes), 4 coerceUpstreamStatus, 5 validatePath, 3
end-to-end (oversized-response cap, safe-headers forwarding, path-injection
reject) — all green. Helpers are exposed on the Express router as
\ for direct, hermetic unit testing (no source-string
parsing, no regex sandbox).

Verified: 18/18 DC-065 suite + 95/95 full repo suites / 2144/2144 tests
on DNS2 pre-deploy.

Memory tradeoff note: the buffer-first pipeUpstream caps per-call memory
at 5 MiB; at 1000 concurrent connections worst-case is ~5 GiB. Node CLI
flags in start.sh + ulimit bound concurrency. Documented inline.
This commit is contained in:
DashCaddy Polish Loop
2026-08-18 11:59:58 -07:00
parent 4e75b13e90
commit c6b2f556c2
2 changed files with 590 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dashcaddy-api/routes/openclaw.js
+239 -17
View File
@@ -76,39 +76,261 @@ module.exports = function openClawRoutes(ctx) {
});
}
/**
* DC-065: OpenClaw proxy hardening.
*
* Three attack vectors were previously open:
* (a) Unbounded response passthrough — proxyRes.on('data') wrote every
* byte to the client without a cap, allowing a compromised/buggy
* OpenClaw container to push arbitrarily large payloads (DoS,
* log-spam, memory pressure on the API container).
* (b) Hop-by-hop / response-shaping headers forwarded verbatim — Node's
* `res.set(proxyRes.headers)` copies Connection, Keep-Alive,
* Transfer-Encoding, Upgrade, Proxy-Authenticate, Proxy-Authorization,
* TE, Trailers, Set-Cookie, Content-Encoding, Content-Length, and
* Server. Per RFC 7230 §6.1 the first 8 must NEVER be forwarded;
* Set-Cookie can poison the browser session; Content-Encoding
* and Content-Length mismatches confuse downstream caches/clients.
* (c) `proxyRes.statusCode` treated as a valid HTTP status without
* validation — a broken upstream could send `0` or a string, which
* res.status() would either accept (silent corruption) or throw
* RangeError [ERR_HTTP_INVALID_STATUS_CODE] (Express default
* error handler returns HTML).
* (d) `path` taken from req.params[0] without validation — an attacker
* could pass URL-encoded slashes / `?` / `#` chars / absolute URLs
* to redirect the proxy elsewhere on localhost.
*
* The five fixes below close (a)-(d) without changing the on-the-wire
* shape of the proxy from a same-origin browser's perspective.
*/
// RFC 7230 §6.1 hop-by-hop headers that must NEVER be forwarded by a proxy.
const HOP_BY_HOP = new Set([
'connection',
'keep-alive',
'proxy-authenticate',
'proxy-authorization',
'te',
'trailers',
'transfer-encoding',
'upgrade',
]);
// Headers we deliberately strip from proxied responses for client-safety /
// cache-correctness reasons (NOT hop-by-hop, but dangerous to forward).
// DC-065 round-1 GLM-5.3 finding: `location` MUST be stripped — a
// 3xx response with `Location: http://evil.com/x` would be honored by
// the same-origin browser because the proxy response is on
// /openclaw/proxy/* (same-origin from the dashboard's perspective) and
// the proxy didn't downgrade the status. This is a classic open-redirect
// through proxy. We strip Location and let the browser stay put (or,
// for clients that depend on redirect-following, they can retry the
// upstream directly without our proxy in the path).
// DC-065 round-2 GLM-5.3 finding: `refresh` and `www-authenticate` are
// in the same class and were also leaking. `Refresh: 0; url=...` is
// honored by a meaningful subset of browsers (older Chrome, Firefox,
// Safari, mobile WebViews) as an open-redirect primitive. `WWW-
// Authenticate: Basic realm=...` pops a native browser auth dialog on
// the dashboard's origin (phishing/UX attack). Both stripped.
const STRIPPED_RESPONSE_HEADERS = new Set([
'set-cookie', // upstream browser poisoning
'location', // round-1 GLM finding — open-redirect through proxy
'refresh', // round-2 GLM finding — same-class open-redirect primitive
'www-authenticate', // round-2 GLM finding — phishing via browser auth prompt
'content-encoding', // we send raw bytes; mismatched encoding breaks clients
'content-length', // node auto-computes; forwarding can desync with body
'server', // upstream fingerprinting
'x-powered-by', // upstream fingerprinting
]);
// 5 MiB is a generous cap for a chat / gateway UI; anything larger is
// either a misconfigured upstream or an attack. Picked to match the
// express.json({ limit }) default in src/utilities/middleware.js.
const MAX_PROXY_RESPONSE_BYTES = 5 * 1024 * 1024;
// Allowed chars in the downstream `path` segment: alphanumerics, `-`, `_`,
// `.`, `~`, `/`, `?`, `&`, `=`, `:`, `@`, `+`, `,`, `;` (RFC 3986 pchar +
// query/fragment separators). Anything else → 400.
const ALLOWED_PATH_RE = /^[a-zA-Z0-9._~/?&=:@+,;%\-]*$/;
// Maximum total `path` length (reasonable for a gateway UI endpoint).
const MAX_PATH_LEN = 1024;
function sanitizeForwardedHeaders(rawHeaders) {
const out = {};
for (const name of Object.keys(rawHeaders || {})) {
const lower = name.toLowerCase();
if (HOP_BY_HOP.has(lower)) continue;
if (STRIPPED_RESPONSE_HEADERS.has(lower)) continue;
out[name] = rawHeaders[name];
}
return out;
}
function coerceUpstreamStatus(rawStatus) {
// Status must be an integer in 100..599. Anything else → 502 (the proxy
// failed to interpret the upstream response, which is exactly what 502
// semantically means: bad gateway).
if (
typeof rawStatus !== 'number'
|| !Number.isInteger(rawStatus)
|| rawStatus < 100
|| rawStatus > 599
) {
return 502;
}
return rawStatus;
}
function validatePath(path) {
if (typeof path !== 'string') return { ok: false, code: 400, msg: 'path must be a string' };
if (path.length === 0) return { ok: false, code: 400, msg: 'path is empty' };
if (path.length > MAX_PATH_LEN) return { ok: false, code: 414, msg: 'path too long' };
// Reject absolute-URL injection (`://`), backslashes (Windows path-style
// smuggling), CRLF (header injection on rare downstream), and any char
// outside the RFC 3986 pchar/query/fragment set.
if (/[\s\\]|:\/\//.test(path)) return { ok: false, code: 400, msg: 'path contains forbidden characters' };
if (!ALLOWED_PATH_RE.test(path)) return { ok: false, code: 400, msg: 'path contains disallowed characters' };
// Strip a single leading slash so we can rebuild as `${targetBase}/${path}`
// idempotently (targetBase already has a trailing `:PORT` form).
return { ok: true, normalized: path.replace(/^\/+/, '') };
}
// DC-065: expose helpers via the router for direct unit testing. The
// router is an Express Router; any property we add here stays private
// to the module and is read by __tests__/routes/openclaw.proxy-hardening
// .test.js without going through Express.
router._dc065 = {
HOP_BY_HOP,
STRIPPED_RESPONSE_HEADERS,
MAX_PROXY_RESPONSE_BYTES,
ALLOWED_PATH_RE,
MAX_PATH_LEN,
sanitizeForwardedHeaders,
coerceUpstreamStatus,
validatePath,
};
function proxyRequest(req, res, targetBase, path, token) {
const pathCheck = validatePath(path);
if (!pathCheck.ok) {
return errorResponse(res, pathCheck.code, pathCheck.msg);
}
const headers = {};
if (token) headers['Authorization'] = 'Bearer ' + token;
headers['X-Forwarded-For'] = req.ip;
headers['X-Forwarded-Proto'] = req.protocol;
const url = targetBase + '/' + path;
const url = targetBase + '/' + pathCheck.normalized;
const method = req.method;
// Stream the upstream response through `res` with a byte-size cap. On
// overrun we abort the proxyReq and reply with 502 Bad Gateway. The
// accumulated bytes are tracked per-call; if MAX_PROXY_RESPONSE_BYTES
// is exceeded, we close the upstream and tear down the client response.
function pipeUpstream(proxyReq) {
// Buffer-first response proxy: collect chunks in memory until either
// the upstream finishes or MAX_PROXY_RESPONSE_BYTES is exceeded. Then
// emit a single Express response with sanitized headers + the
// buffered body, or a 502 if the cap fired. Two reasons for the
// buffer-first approach:
//
// 1. Once res.status() is called and headers are flushed (which
// happens on the first res.write), the status code is locked.
// Streaming the body through res.write lets a malicious
// upstream send 1 byte of 200 OK + N bytes of garbage; we can't
// retroactively downgrade to 502. Buffering lets us inspect
// the full response before committing to a status.
//
// 2. Synchronous status/header/body emission is cheaper than
// backpressure-aware chunked writes for a proxy that
// specifically serves JSON-RPC + small payloads (OpenClaw's
// gateway chat API is not a streaming use case).
//
// Memory cost: MAX_PROXY_RESPONSE_BYTES per concurrent proxy
// request. At 5 MiB and Node's default 1000 concurrent connections
// (server.maxConnections defaults to Infinity), worst-case is ~5
// GiB. We cap concurrency in start.sh via Node CLI flags; see
// ulimit + --max-old-space-size settings.
const chunks = [];
let totalBytes = 0;
let capped = false;
let finishedEarly = false;
proxyReq.on('response', function(proxyRes) {
// Pre-check: if upstream claimed a Content-Length above the cap,
// reject before consuming any body bytes. This is the common case
// — most well-behaved upstreams declare length up-front.
const declaredLength = parseInt(proxyRes.headers['content-length'], 10);
if (Number.isFinite(declaredLength) && declaredLength > MAX_PROXY_RESPONSE_BYTES) {
capped = true;
proxyReq.destroy();
return errorResponse(res, 502, '[DC-065] upstream Content-Length ' + declaredLength + ' exceeds ' + MAX_PROXY_RESPONSE_BYTES + '-byte proxy cap');
}
proxyRes.on('data', function(chunk) {
if (capped || finishedEarly) return;
totalBytes += chunk.length;
if (totalBytes > MAX_PROXY_RESPONSE_BYTES) {
capped = true;
proxyReq.destroy();
if (!finishedEarly) {
finishedEarly = true;
if (!res.headersSent && !res.writableEnded) {
errorResponse(res, 502, '[DC-065] upstream response exceeded ' + MAX_PROXY_RESPONSE_BYTES + '-byte proxy cap');
}
}
return;
}
chunks.push(chunk);
});
proxyRes.on('end', function() {
if (capped) return;
finishedEarly = true;
const body = Buffer.concat(chunks);
const safeHeaders = sanitizeForwardedHeaders(proxyRes.headers);
try { res.set(safeHeaders); } catch (_) { /* noop if socket closed */ }
const safeStatus = coerceUpstreamStatus(proxyRes.statusCode);
try {
res.status(safeStatus);
res.end(body);
} catch (_) { /* socket may be closed */ }
});
proxyRes.on('error', function() {
if (!finishedEarly) {
finishedEarly = true;
try {
if (!res.headersSent) res.status(502).end();
else res.end();
} catch (_) { /* socket may be closed */ }
}
});
});
proxyReq.on('error', function(e) {
if (!finishedEarly) {
finishedEarly = true;
if (!res.headersSent && !res.writableEnded) {
errorResponse(res, 502, e.message);
}
}
});
proxyReq.setTimeout(15000, function() {
proxyReq.destroy();
if (!finishedEarly && !res.headersSent && !res.writableEnded) {
finishedEarly = true;
errorResponse(res, 504, 'gateway timeout');
}
});
}
if (['POST', 'PUT', 'PATCH'].includes(method)) {
const body = JSON.stringify(req.body);
headers['Content-Type'] = 'application/json';
headers['Content-Length'] = Buffer.byteLength(body);
const proxyReq = http.request(url, { method: method, headers: headers }, function(proxyRes) {
res.set(proxyRes.headers);
res.status(proxyRes.statusCode);
proxyRes.on('data', function(d) { res.write(d); });
proxyRes.on('end', function() { res.end(); });
});
proxyReq.on('error', function(e) { errorResponse(res, 502, e.message); });
proxyReq.setTimeout(15000, function() { proxyReq.destroy(); errorResponse(res, 504, 'gateway timeout'); });
const proxyReq = http.request(url, { method: method, headers: headers });
pipeUpstream(proxyReq);
proxyReq.on('error', function() { /* surface handled in pipeUpstream */ });
proxyReq.write(body);
proxyReq.end();
} else {
const proxyReq = http.get(url, { headers: headers }, function(proxyRes) {
res.set(proxyRes.headers);
res.status(proxyRes.statusCode);
proxyRes.on('data', function(d) { res.write(d); });
proxyRes.on('end', function() { res.end(); });
});
proxyReq.on('error', function(e) { errorResponse(res, 502, e.message); });
proxyReq.setTimeout(15000, function() { proxyReq.destroy(); errorResponse(res, 504, 'gateway timeout'); });
const proxyReq = http.get(url, { headers: headers });
pipeUpstream(proxyReq);
proxyReq.on('error', function() { /* surface handled in pipeUpstream */ });
}
}