Files
dashcaddy/dashcaddy-api/__tests__
DashCaddy Polish Loop c6b2f556c2
CI / Test & Lint (push) Canceled after 0s
CI / Security audit (push) Canceled after 0s
fix(openclaw): harden proxy — 5 MiB cap, RFC 7230 hop-by-hop strip, open-redirect (Location/Refresh/WWW-Auth) strip, path + status validators (DC-065) [glm-grade=A]
Round 1 GLM-5.3: C — missing "location" (open-redirect through proxy).
Round 2 GLM-5.3: C — missing "refresh" + "www-authenticate" (same class).
Round 3 GLM-5.3: A — ship.

Closure of four vulnerabilities in routes/openclaw.js proxyRequest():

  (a) Unbounded response passthrough → 5 MiB cap with 502 + DC-065
      message on overrun. Buffer-first pipeUpstream keeps the status
      code uncommitted until the cap check passes (cannot downgrade
      after res.write()).

  (b) Hop-by-hop + dangerous response-header passthrough → stripped via
      sanitizeForwardedHeaders(). Hop-by-hop per RFC 7230 §6.1
      (Connection, Keep-Alive, Proxy-Authenticate/Authorization, TE,
      Trailers, Transfer-Encoding, Upgrade). Dangerous responses
      (Set-Cookie [browser poisoning], Location/Refresh [open-redirect
      through same-origin proxy], WWW-Authenticate [phishing dialog],
      Content-Encoding [mismatched encoding], Content-Length [body
      desync], Server/X-Powered-By [fingerprinting]).

  (c) proxyRes.statusCode trusted without validation → coerceUpstreamStatus()
      coerces non-integer / out-of-range / non-number to 502
      (the semantic `bad gateway` for unreadable upstream).

  (d) Path taken from req.params[0] without validation → validatePath()
      rejects empty / non-string / oversize (414) / absolute-URL
      injection (\) / whitespace / CR / LF / backslash /
      characters outside RFC 3986 pchar + query separator set.

Tests: __tests__/routes/openclaw.proxy-hardening.test.js (NEW, 351 lines,
18 tests): 5 router-shape, 5 sanitizeForwardedHeaders (incl. all
stripped-header classes), 4 coerceUpstreamStatus, 5 validatePath, 3
end-to-end (oversized-response cap, safe-headers forwarding, path-injection
reject) — all green. Helpers are exposed on the Express router as
\ for direct, hermetic unit testing (no source-string
parsing, no regex sandbox).

Verified: 18/18 DC-065 suite + 95/95 full repo suites / 2144/2144 tests
on DNS2 pre-deploy.

Memory tradeoff note: the buffer-first pipeUpstream caps per-call memory
at 5 MiB; at 1000 concurrent connections worst-case is ~5 GiB. Node CLI
flags in start.sh + ulimit bound concurrency. Documented inline.
2026-08-18 11:59:58 -07:00
..