DashCaddy Polish Loop
c6b2f556c2
CI / Test & Lint (push) Canceled after 0s
CI / Security audit (push) Canceled after 0s
fix(openclaw): harden proxy — 5 MiB cap, RFC 7230 hop-by-hop strip, open-redirect (Location/Refresh/WWW-Auth) strip, path + status validators (DC-065) [glm-grade=A]
Round 1 GLM-5.3: C — missing "location" (open-redirect through proxy).
Round 2 GLM-5.3: C — missing "refresh" + "www-authenticate" (same class).
Round 3 GLM-5.3: A — ship.
Closure of four vulnerabilities in routes/openclaw.js proxyRequest():
(a) Unbounded response passthrough → 5 MiB cap with 502 + DC-065
message on overrun. Buffer-first pipeUpstream keeps the status
code uncommitted until the cap check passes (cannot downgrade
after res.write()).
(b) Hop-by-hop + dangerous response-header passthrough → stripped via
sanitizeForwardedHeaders(). Hop-by-hop per RFC 7230 §6.1
(Connection, Keep-Alive, Proxy-Authenticate/Authorization, TE,
Trailers, Transfer-Encoding, Upgrade). Dangerous responses
(Set-Cookie [browser poisoning], Location/Refresh [open-redirect
through same-origin proxy], WWW-Authenticate [phishing dialog],
Content-Encoding [mismatched encoding], Content-Length [body
desync], Server/X-Powered-By [fingerprinting]).
(c) proxyRes.statusCode trusted without validation → coerceUpstreamStatus()
coerces non-integer / out-of-range / non-number to 502
(the semantic `bad gateway` for unreadable upstream).
(d) Path taken from req.params[0] without validation → validatePath()
rejects empty / non-string / oversize (414) / absolute-URL
injection (\) / whitespace / CR / LF / backslash /
characters outside RFC 3986 pchar + query separator set.
Tests: __tests__/routes/openclaw.proxy-hardening.test.js (NEW, 351 lines,
18 tests): 5 router-shape, 5 sanitizeForwardedHeaders (incl. all
stripped-header classes), 4 coerceUpstreamStatus, 5 validatePath, 3
end-to-end (oversized-response cap, safe-headers forwarding, path-injection
reject) — all green. Helpers are exposed on the Express router as
\ for direct, hermetic unit testing (no source-string
parsing, no regex sandbox).
Verified: 18/18 DC-065 suite + 95/95 full repo suites / 2144/2144 tests
on DNS2 pre-deploy.
Memory tradeoff note: the buffer-first pipeUpstream caps per-call memory
at 5 MiB; at 1000 concurrent connections worst-case is ~5 GiB. Node CLI
flags in start.sh + ulimit bound concurrency. Documented inline.
2026-08-18 11:59:58 -07:00
..
2026-08-14 22:39:22 -07:00
2026-06-13 12:16:56 -07:00
2026-08-12 16:30:17 -07:00
2026-08-12 12:25:26 -07:00
2026-08-18 11:59:58 -07:00
2026-06-26 12:16:38 -07:00
2026-08-08 15:39:48 -07:00
2026-08-18 08:22:29 -07:00
2026-07-01 07:37:45 -07:00
2026-06-13 12:16:56 -07:00
2026-07-01 04:20:57 -07:00
2026-06-13 12:16:56 -07:00
2026-07-20 17:44:11 -07:00
2026-07-20 01:40:33 -07:00
2026-07-02 18:27:03 -07:00
2026-08-18 05:52:32 -07:00
2026-06-27 07:02:47 -07:00
2026-07-31 00:43:29 -07:00
2026-08-18 00:13:58 -07:00
2026-06-13 12:16:56 -07:00
2026-08-12 12:35:58 -07:00
2026-06-13 12:16:56 -07:00
2026-06-13 12:16:56 -07:00
2026-08-18 04:17:50 -07:00
2026-06-26 12:16:38 -07:00
2026-08-17 16:04:18 -07:00
2026-06-13 12:16:56 -07:00
2026-06-13 12:16:56 -07:00
2026-08-12 04:50:16 -07:00
2026-08-12 12:30:57 -07:00
2026-06-13 12:16:56 -07:00
2026-07-05 12:58:13 -07:00
2026-07-08 21:33:06 -07:00
2026-07-08 21:33:06 -07:00
2026-08-13 16:30:20 -07:00
2026-06-13 12:16:56 -07:00
2026-07-20 17:44:11 -07:00
2026-04-06 21:36:46 -07:00
2026-08-04 14:18:49 -07:00
2026-08-12 16:11:15 -07:00
2026-07-20 21:40:26 -07:00
2026-06-13 12:16:56 -07:00
2026-06-25 17:16:16 -07:00
2026-08-12 12:35:58 -07:00
2026-08-18 01:29:19 -07:00
2026-07-06 15:06:28 -07:00
2026-06-13 12:16:56 -07:00
2026-06-13 12:16:56 -07:00
2026-08-12 05:07:24 -07:00
2026-06-13 12:16:56 -07:00
2026-07-21 21:59:03 -07:00
2026-08-14 23:46:23 -07:00
2026-06-13 12:16:56 -07:00
2026-07-24 22:39:29 -07:00
2026-07-24 05:15:08 -07:00
2026-07-21 00:45:46 -07:00
2026-07-21 00:45:46 -07:00
2026-06-13 12:16:56 -07:00
2026-07-24 16:03:34 -07:00
2026-06-13 12:16:56 -07:00
2026-07-06 21:28:03 -07:00
2026-07-06 18:55:16 -07:00
2026-08-12 12:35:58 -07:00
2026-06-13 12:16:56 -07:00
2026-07-20 17:44:11 -07:00
2026-08-17 19:51:59 -07:00
2026-08-18 01:59:14 -07:00
2026-08-18 09:03:58 -07:00
2026-08-15 00:01:16 -07:00