Hermes
c28322eb46
- routes/ca.js: declare format before pfx/pem/crt dispatch (was ReferenceError on every request that passed validation); add CA_CERT_FORMATS single source of truth + hardened format extraction (string-coerce, whitelist) - routes/caddycode.js: fix upstream-validation regexes (control-char classes) - routes/logs.js: SSE/validation lint fixes - routes/openclaw.js: remove useless regex escape in ALLOWED_PATH_RE - fleet-validation.js + http-caddy-admin-origin test: eslint-disable for intentional control-regex security sentinels - ca-dc076.routes.test.js: regression test for declared format + behavioral coverage of format validation (now pre-PKI) Judge: Qwen lane (qwen3.8-max) grade B, 0 blocking, verdict /tmp/judge-batch1-verdict.json. API suite 2859/2859 green.
491 lines
20 KiB
JavaScript
491 lines
20 KiB
JavaScript
const express = require('express');
|
|
const http = require('http');
|
|
const crypto = require('crypto');
|
|
const { ok, errorResponse, notFound, conflict } = require('../src/utils/responses');
|
|
|
|
/**
|
|
* OpenClaw management routes
|
|
* Proxies gateway API calls through DashCaddy so the token never leaves the server.
|
|
*
|
|
* GET /openclaw/status → container info + gateway health
|
|
* POST /openclaw/deploy → deploy OpenClaw container
|
|
* GET /openclaw/proxy/* → proxy GET to gateway
|
|
* POST /openclaw/proxy/* → proxy POST to gateway
|
|
* DELETE /openclaw → remove container
|
|
*/
|
|
module.exports = function openClawRoutes(ctx) {
|
|
const router = express.Router();
|
|
const docker = ctx.docker;
|
|
const asyncHandler = ctx.asyncHandler;
|
|
const ok = ctx.ok;
|
|
const log = ctx.log || console;
|
|
|
|
// ── helpers ──────────────────────────────────────────────────────────────
|
|
|
|
async function findOpenClawContainer() {
|
|
const containers = await docker.client.listContainers({ all: true });
|
|
return containers.find(function(c) {
|
|
return c.Image === 'ghcr.io/nousresearch/openclaw:latest' ||
|
|
(c.Labels && c.Labels['dashcaddy.managed'] === 'true' &&
|
|
c.Names.some(function(n) { return n.includes('openclaw'); }));
|
|
}) || null;
|
|
}
|
|
|
|
async function getGatewayToken(containerId) {
|
|
try {
|
|
const info = await docker.client.containerInfo(containerId);
|
|
const entry = (info.Config.Env || []).find(function(e) {
|
|
return e.startsWith('OPENCLAW_GATEWAY_TOKEN=');
|
|
});
|
|
return entry ? entry.split('=')[1] : null;
|
|
} catch(err) {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
async function getContainerPort(containerId) {
|
|
try {
|
|
const containers = await docker.client.listContainers({ all: true });
|
|
const c = containers.find(function(x) {
|
|
return x.Id === containerId || x.Id.startsWith(containerId);
|
|
});
|
|
if (c && c.Ports) {
|
|
const p = c.Ports.find(function(x) { return x.PrivatePort === 18792; });
|
|
if (p && p.PublicPort) return String(p.PublicPort);
|
|
}
|
|
return '18792';
|
|
} catch(err) {
|
|
return '18792';
|
|
}
|
|
}
|
|
|
|
async function gatewayHealth(baseUrl, token) {
|
|
return new Promise(function(resolve) {
|
|
const headers = {};
|
|
if (token) headers['Authorization'] = 'Bearer ' + token;
|
|
const req = http.get(baseUrl + '/health', { headers: headers }, function(res) {
|
|
let data = '';
|
|
res.on('data', function(d) { data += d; });
|
|
res.on('end', function() {
|
|
try { resolve({ ok: true, data: JSON.parse(data) }); }
|
|
catch(e) { resolve({ ok: true, data: data }); }
|
|
});
|
|
});
|
|
req.on('error', function(e) { resolve({ ok: false, error: e.message }); });
|
|
req.setTimeout(5000, function() { req.destroy(); resolve({ ok: false, error: 'timeout' }); });
|
|
});
|
|
}
|
|
|
|
/**
|
|
* DC-065: OpenClaw proxy hardening.
|
|
*
|
|
* Three attack vectors were previously open:
|
|
* (a) Unbounded response passthrough — proxyRes.on('data') wrote every
|
|
* byte to the client without a cap, allowing a compromised/buggy
|
|
* OpenClaw container to push arbitrarily large payloads (DoS,
|
|
* log-spam, memory pressure on the API container).
|
|
* (b) Hop-by-hop / response-shaping headers forwarded verbatim — Node's
|
|
* `res.set(proxyRes.headers)` copies Connection, Keep-Alive,
|
|
* Transfer-Encoding, Upgrade, Proxy-Authenticate, Proxy-Authorization,
|
|
* TE, Trailers, Set-Cookie, Content-Encoding, Content-Length, and
|
|
* Server. Per RFC 7230 §6.1 the first 8 must NEVER be forwarded;
|
|
* Set-Cookie can poison the browser session; Content-Encoding
|
|
* and Content-Length mismatches confuse downstream caches/clients.
|
|
* (c) `proxyRes.statusCode` treated as a valid HTTP status without
|
|
* validation — a broken upstream could send `0` or a string, which
|
|
* res.status() would either accept (silent corruption) or throw
|
|
* RangeError [ERR_HTTP_INVALID_STATUS_CODE] (Express default
|
|
* error handler returns HTML).
|
|
* (d) `path` taken from req.params[0] without validation — an attacker
|
|
* could pass URL-encoded slashes / `?` / `#` chars / absolute URLs
|
|
* to redirect the proxy elsewhere on localhost.
|
|
*
|
|
* The five fixes below close (a)-(d) without changing the on-the-wire
|
|
* shape of the proxy from a same-origin browser's perspective.
|
|
*/
|
|
// RFC 7230 §6.1 hop-by-hop headers that must NEVER be forwarded by a proxy.
|
|
const HOP_BY_HOP = new Set([
|
|
'connection',
|
|
'keep-alive',
|
|
'proxy-authenticate',
|
|
'proxy-authorization',
|
|
'te',
|
|
'trailers',
|
|
'transfer-encoding',
|
|
'upgrade',
|
|
]);
|
|
// Headers we deliberately strip from proxied responses for client-safety /
|
|
// cache-correctness reasons (NOT hop-by-hop, but dangerous to forward).
|
|
// DC-065 round-1 GLM-5.3 finding: `location` MUST be stripped — a
|
|
// 3xx response with `Location: http://evil.com/x` would be honored by
|
|
// the same-origin browser because the proxy response is on
|
|
// /openclaw/proxy/* (same-origin from the dashboard's perspective) and
|
|
// the proxy didn't downgrade the status. This is a classic open-redirect
|
|
// through proxy. We strip Location and let the browser stay put (or,
|
|
// for clients that depend on redirect-following, they can retry the
|
|
// upstream directly without our proxy in the path).
|
|
// DC-065 round-2 GLM-5.3 finding: `refresh` and `www-authenticate` are
|
|
// in the same class and were also leaking. `Refresh: 0; url=...` is
|
|
// honored by a meaningful subset of browsers (older Chrome, Firefox,
|
|
// Safari, mobile WebViews) as an open-redirect primitive. `WWW-
|
|
// Authenticate: Basic realm=...` pops a native browser auth dialog on
|
|
// the dashboard's origin (phishing/UX attack). Both stripped.
|
|
const STRIPPED_RESPONSE_HEADERS = new Set([
|
|
'set-cookie', // upstream browser poisoning
|
|
'location', // round-1 GLM finding — open-redirect through proxy
|
|
'refresh', // round-2 GLM finding — same-class open-redirect primitive
|
|
'www-authenticate', // round-2 GLM finding — phishing via browser auth prompt
|
|
'content-encoding', // we send raw bytes; mismatched encoding breaks clients
|
|
'content-length', // node auto-computes; forwarding can desync with body
|
|
'server', // upstream fingerprinting
|
|
'x-powered-by', // upstream fingerprinting
|
|
]);
|
|
// 5 MiB is a generous cap for a chat / gateway UI; anything larger is
|
|
// either a misconfigured upstream or an attack. Picked to match the
|
|
// express.json({ limit }) default in src/utilities/middleware.js.
|
|
const MAX_PROXY_RESPONSE_BYTES = 5 * 1024 * 1024;
|
|
// Allowed chars in the downstream `path` segment: alphanumerics, `-`, `_`,
|
|
// `.`, `~`, `/`, `?`, `&`, `=`, `:`, `@`, `+`, `,`, `;` (RFC 3986 pchar +
|
|
// query/fragment separators). Anything else → 400.
|
|
const ALLOWED_PATH_RE = /^[a-zA-Z0-9._~/?&=:@+,;%-]*$/;
|
|
// Maximum total `path` length (reasonable for a gateway UI endpoint).
|
|
const MAX_PATH_LEN = 1024;
|
|
|
|
function sanitizeForwardedHeaders(rawHeaders) {
|
|
const out = {};
|
|
for (const name of Object.keys(rawHeaders || {})) {
|
|
const lower = name.toLowerCase();
|
|
if (HOP_BY_HOP.has(lower)) continue;
|
|
if (STRIPPED_RESPONSE_HEADERS.has(lower)) continue;
|
|
out[name] = rawHeaders[name];
|
|
}
|
|
return out;
|
|
}
|
|
|
|
function coerceUpstreamStatus(rawStatus) {
|
|
// Status must be an integer in 100..599. Anything else → 502 (the proxy
|
|
// failed to interpret the upstream response, which is exactly what 502
|
|
// semantically means: bad gateway).
|
|
if (
|
|
typeof rawStatus !== 'number'
|
|
|| !Number.isInteger(rawStatus)
|
|
|| rawStatus < 100
|
|
|| rawStatus > 599
|
|
) {
|
|
return 502;
|
|
}
|
|
return rawStatus;
|
|
}
|
|
|
|
function validatePath(path) {
|
|
if (typeof path !== 'string') return { ok: false, code: 400, msg: 'path must be a string' };
|
|
if (path.length === 0) return { ok: false, code: 400, msg: 'path is empty' };
|
|
if (path.length > MAX_PATH_LEN) return { ok: false, code: 414, msg: 'path too long' };
|
|
// Reject absolute-URL injection (`://`), backslashes (Windows path-style
|
|
// smuggling), CRLF (header injection on rare downstream), and any char
|
|
// outside the RFC 3986 pchar/query/fragment set.
|
|
if (/[\s\\]|:\/\//.test(path)) return { ok: false, code: 400, msg: 'path contains forbidden characters' };
|
|
if (!ALLOWED_PATH_RE.test(path)) return { ok: false, code: 400, msg: 'path contains disallowed characters' };
|
|
// Strip a single leading slash so we can rebuild as `${targetBase}/${path}`
|
|
// idempotently (targetBase already has a trailing `:PORT` form).
|
|
return { ok: true, normalized: path.replace(/^\/+/, '') };
|
|
}
|
|
|
|
// DC-065: expose helpers via the router for direct unit testing. The
|
|
// router is an Express Router; any property we add here stays private
|
|
// to the module and is read by __tests__/routes/openclaw.proxy-hardening
|
|
// .test.js without going through Express.
|
|
router._dc065 = {
|
|
HOP_BY_HOP,
|
|
STRIPPED_RESPONSE_HEADERS,
|
|
MAX_PROXY_RESPONSE_BYTES,
|
|
ALLOWED_PATH_RE,
|
|
MAX_PATH_LEN,
|
|
sanitizeForwardedHeaders,
|
|
coerceUpstreamStatus,
|
|
validatePath,
|
|
};
|
|
|
|
function proxyRequest(req, res, targetBase, path, token) {
|
|
const pathCheck = validatePath(path);
|
|
if (!pathCheck.ok) {
|
|
return errorResponse(res, pathCheck.code, pathCheck.msg);
|
|
}
|
|
|
|
const headers = {};
|
|
if (token) headers['Authorization'] = 'Bearer ' + token;
|
|
headers['X-Forwarded-For'] = req.ip;
|
|
headers['X-Forwarded-Proto'] = req.protocol;
|
|
|
|
const url = targetBase + '/' + pathCheck.normalized;
|
|
const method = req.method;
|
|
|
|
// Stream the upstream response through `res` with a byte-size cap. On
|
|
// overrun we abort the proxyReq and reply with 502 Bad Gateway. The
|
|
// accumulated bytes are tracked per-call; if MAX_PROXY_RESPONSE_BYTES
|
|
// is exceeded, we close the upstream and tear down the client response.
|
|
function pipeUpstream(proxyReq) {
|
|
// Buffer-first response proxy: collect chunks in memory until either
|
|
// the upstream finishes or MAX_PROXY_RESPONSE_BYTES is exceeded. Then
|
|
// emit a single Express response with sanitized headers + the
|
|
// buffered body, or a 502 if the cap fired. Two reasons for the
|
|
// buffer-first approach:
|
|
//
|
|
// 1. Once res.status() is called and headers are flushed (which
|
|
// happens on the first res.write), the status code is locked.
|
|
// Streaming the body through res.write lets a malicious
|
|
// upstream send 1 byte of 200 OK + N bytes of garbage; we can't
|
|
// retroactively downgrade to 502. Buffering lets us inspect
|
|
// the full response before committing to a status.
|
|
//
|
|
// 2. Synchronous status/header/body emission is cheaper than
|
|
// backpressure-aware chunked writes for a proxy that
|
|
// specifically serves JSON-RPC + small payloads (OpenClaw's
|
|
// gateway chat API is not a streaming use case).
|
|
//
|
|
// Memory cost: MAX_PROXY_RESPONSE_BYTES per concurrent proxy
|
|
// request. At 5 MiB and Node's default 1000 concurrent connections
|
|
// (server.maxConnections defaults to Infinity), worst-case is ~5
|
|
// GiB. We cap concurrency in start.sh via Node CLI flags; see
|
|
// ulimit + --max-old-space-size settings.
|
|
const chunks = [];
|
|
let totalBytes = 0;
|
|
let capped = false;
|
|
let finishedEarly = false;
|
|
proxyReq.on('response', function(proxyRes) {
|
|
// Pre-check: if upstream claimed a Content-Length above the cap,
|
|
// reject before consuming any body bytes. This is the common case
|
|
// — most well-behaved upstreams declare length up-front.
|
|
const declaredLength = parseInt(proxyRes.headers['content-length'], 10);
|
|
if (Number.isFinite(declaredLength) && declaredLength > MAX_PROXY_RESPONSE_BYTES) {
|
|
capped = true;
|
|
proxyReq.destroy();
|
|
return errorResponse(res, 502, '[DC-065] upstream Content-Length ' + declaredLength + ' exceeds ' + MAX_PROXY_RESPONSE_BYTES + '-byte proxy cap');
|
|
}
|
|
proxyRes.on('data', function(chunk) {
|
|
if (capped || finishedEarly) return;
|
|
totalBytes += chunk.length;
|
|
if (totalBytes > MAX_PROXY_RESPONSE_BYTES) {
|
|
capped = true;
|
|
proxyReq.destroy();
|
|
if (!finishedEarly) {
|
|
finishedEarly = true;
|
|
if (!res.headersSent && !res.writableEnded) {
|
|
errorResponse(res, 502, '[DC-065] upstream response exceeded ' + MAX_PROXY_RESPONSE_BYTES + '-byte proxy cap');
|
|
}
|
|
}
|
|
return;
|
|
}
|
|
chunks.push(chunk);
|
|
});
|
|
proxyRes.on('end', function() {
|
|
if (capped) return;
|
|
finishedEarly = true;
|
|
const body = Buffer.concat(chunks);
|
|
const safeHeaders = sanitizeForwardedHeaders(proxyRes.headers);
|
|
try { res.set(safeHeaders); } catch (_) { /* noop if socket closed */ }
|
|
const safeStatus = coerceUpstreamStatus(proxyRes.statusCode);
|
|
try {
|
|
res.status(safeStatus);
|
|
res.end(body);
|
|
} catch (_) { /* socket may be closed */ }
|
|
});
|
|
proxyRes.on('error', function() {
|
|
if (!finishedEarly) {
|
|
finishedEarly = true;
|
|
try {
|
|
if (!res.headersSent) res.status(502).end();
|
|
else res.end();
|
|
} catch (_) { /* socket may be closed */ }
|
|
}
|
|
});
|
|
});
|
|
proxyReq.on('error', function(e) {
|
|
if (!finishedEarly) {
|
|
finishedEarly = true;
|
|
if (!res.headersSent && !res.writableEnded) {
|
|
errorResponse(res, 502, e.message);
|
|
}
|
|
}
|
|
});
|
|
proxyReq.setTimeout(15000, function() {
|
|
proxyReq.destroy();
|
|
if (!finishedEarly && !res.headersSent && !res.writableEnded) {
|
|
finishedEarly = true;
|
|
errorResponse(res, 504, 'gateway timeout');
|
|
}
|
|
});
|
|
}
|
|
|
|
if (['POST', 'PUT', 'PATCH'].includes(method)) {
|
|
const body = JSON.stringify(req.body);
|
|
headers['Content-Type'] = 'application/json';
|
|
headers['Content-Length'] = Buffer.byteLength(body);
|
|
|
|
const proxyReq = http.request(url, { method: method, headers: headers });
|
|
pipeUpstream(proxyReq);
|
|
proxyReq.on('error', function() { /* surface handled in pipeUpstream */ });
|
|
proxyReq.write(body);
|
|
proxyReq.end();
|
|
} else {
|
|
const proxyReq = http.get(url, { headers: headers });
|
|
pipeUpstream(proxyReq);
|
|
proxyReq.on('error', function() { /* surface handled in pipeUpstream */ });
|
|
}
|
|
}
|
|
|
|
// ── GET /openclaw/status ────────────────────────────────────────────────
|
|
|
|
router.get('/status', asyncHandler(async function(req, res) {
|
|
const container = await findOpenClawContainer();
|
|
|
|
if (!container) {
|
|
return ok(res, { deployed: false });
|
|
}
|
|
|
|
const token = await getGatewayToken(container.Id);
|
|
const port = await getContainerPort(container.Id);
|
|
const baseUrl = 'http://localhost:' + port;
|
|
const health = await gatewayHealth(baseUrl, token);
|
|
|
|
ok(res, {
|
|
deployed: true,
|
|
container: {
|
|
id: container.Id.slice(0, 12),
|
|
name: container.Name,
|
|
state: container.State,
|
|
status: container.Status,
|
|
created: container.Created,
|
|
image: container.Image
|
|
},
|
|
gateway: {
|
|
url: baseUrl,
|
|
port: port,
|
|
healthy: health.ok,
|
|
healthData: health.data || null,
|
|
tokenSet: !!token
|
|
}
|
|
});
|
|
}));
|
|
|
|
// ── POST /openclaw/deploy ───────────────────────────────────────────────
|
|
|
|
router.post('/deploy', asyncHandler(async function(req, res) {
|
|
const existing = await findOpenClawContainer();
|
|
if (existing) {
|
|
return conflict(res, 'OpenClaw is already deployed');
|
|
}
|
|
|
|
const image = 'ghcr.io/nousresearch/openclaw:latest';
|
|
const name = 'openclaw-' + Date.now();
|
|
const gatewayToken = generateToken();
|
|
|
|
// Pull image
|
|
log.info('Pulling ' + image + '...');
|
|
try {
|
|
await new Promise(function(resolve, reject) {
|
|
docker.client.pull(image, function(err, stream) {
|
|
if (err) return reject(err);
|
|
docker.client.modem.followProgress(stream, function(err2) {
|
|
if (err2) return reject(err2);
|
|
resolve();
|
|
});
|
|
});
|
|
});
|
|
} catch(e) {
|
|
log.error('OpenClaw pull failed: ' + e.message);
|
|
return errorResponse(res, 500, 'Failed to pull image: ' + e.message);
|
|
}
|
|
|
|
// Create + start container
|
|
try {
|
|
const container = await docker.client.createContainer({
|
|
name: name,
|
|
Image: image,
|
|
Env: [
|
|
'OPENCLAW_GATEWAY_MODE=local',
|
|
'OPENCLAW_GATEWAY_TOKEN=' + gatewayToken
|
|
],
|
|
HostConfig: {
|
|
PortBindings: { '18792/tcp': [{ HostPort: '18792' }] },
|
|
RestartPolicy: { Name: 'unless-stopped' },
|
|
Labels: {
|
|
'dashcaddy.managed': 'true',
|
|
'dashcaddy.app': 'openclaw'
|
|
}
|
|
},
|
|
ExposedPorts: { '18792/tcp': {} }
|
|
});
|
|
|
|
await container.start();
|
|
log.info('OpenClaw deployed: ' + container.id.slice(0, 12));
|
|
|
|
ok(res, {
|
|
deployed: true,
|
|
container: { id: container.id.slice(0, 12), name: name },
|
|
gateway: {
|
|
url: 'http://localhost:18792',
|
|
token: gatewayToken
|
|
}
|
|
});
|
|
} catch(e) {
|
|
log.error('OpenClaw deploy failed: ' + e.message);
|
|
errorResponse(res, 500, 'Deploy failed: ' + e.message);
|
|
}
|
|
}));
|
|
|
|
// ── GET /openclaw/proxy/* ───────────────────────────────────────────────
|
|
|
|
router.get('/proxy/*', asyncHandler(async function(req, res) {
|
|
const container = await findOpenClawContainer();
|
|
if (!container) return notFound(res, 'OpenClaw not deployed');
|
|
|
|
const token = await getGatewayToken(container.Id);
|
|
const port = await getContainerPort(container.Id);
|
|
const baseUrl = 'http://localhost:' + port;
|
|
const path = req.params[0];
|
|
|
|
proxyRequest(req, res, baseUrl, path, token);
|
|
}));
|
|
|
|
// ── POST /openclaw/proxy/* ──────────────────────────────────────────────
|
|
|
|
router.post('/proxy/*', asyncHandler(async function(req, res) {
|
|
const container = await findOpenClawContainer();
|
|
if (!container) return notFound(res, 'OpenClaw not deployed');
|
|
|
|
const token = await getGatewayToken(container.Id);
|
|
const port = await getContainerPort(container.Id);
|
|
const baseUrl = 'http://localhost:' + port;
|
|
const path = req.params[0];
|
|
|
|
proxyRequest(req, res, baseUrl, path, token);
|
|
}));
|
|
|
|
// ── DELETE /openclaw ───────────────────────────────────────────────────
|
|
|
|
router.delete('/', asyncHandler(async function(req, res) {
|
|
const container = await findOpenClawContainer();
|
|
if (!container) return notFound(res, 'OpenClaw not deployed');
|
|
|
|
try {
|
|
const c = docker.client.container(container.Id);
|
|
await c.stop().catch(function() {});
|
|
await c.remove({ force: true });
|
|
log.info('OpenClaw container ' + container.Id.slice(0, 12) + ' removed');
|
|
ok(res, { message: 'OpenClaw removed' });
|
|
} catch(e) {
|
|
log.error('Failed to remove OpenClaw: ' + e.message);
|
|
errorResponse(res, 500, e.message);
|
|
}
|
|
}));
|
|
|
|
return router;
|
|
};
|
|
|
|
// ── token generator ──────────────────────────────────────────────────────────
|
|
|
|
function generateToken() {
|
|
return crypto.randomBytes(24).toString('base64url');
|
|
}
|