T09 · Insecure Skill Coding Practices
Error
- Location
scripts/cleaner.sh:55- Finding
Whitelist Parsing Failure Allows Protected Files to Be Deleted or Archived
- Content
View full analysis
Vulnerability Details
File Location:
scripts/cleaner.sh, lines 55-73
Vulnerability Type: Ineffective security control caused by unsafe YAML parsing
Risk Level: HighVulnerable Code
bash # ---------- 解析白名单 ---------- WHITELIST=() while IFS= read -r line; do line=$(echo "$line" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//') [[ -z "$line" || "$line" =~ ^# ]] && continue [[ "$line" == "whitelist:" ]] && continue WHITELIST+=("${line//\~/${HOME}}") done < <(grep -A 20 "^whitelist:" "$CONFIG" 2>/dev/null || true) # ---------- 白名单检查 ---------- is_whitelisted() { local f="$1" for w in "${WHITELIST[@]:-}"; do [[ "$f" == "$w" || "$f" == "$w"/* ]] && return 0 done return 1 }The corresponding entries in
config.yaml, lines 56-59, use standard YAML list syntax:yaml whitelist: - "~/.openclaw/workspace/SOUL.md" - "~/.openclaw/workspace/MEMORY.md"Technical Analysis
The custom parser trims whitespace but does not remove the YAML list marker (
-) or surrounding quotes. An entry such as:yaml - "~/.openclaw/workspace/SOUL.md"is therefore stored in the array as a value resembling:
text - "/home/user/.openclaw/workspace/SOUL.md"This does not equal the actual path passed to
is_whitelisted, so the intended protection is ineffective. The parser also usesgrep -A 20, which is not structurally aware of YAML and can consume unrelated lines following the whitelist section.Attack Path
- An attacker or configuration author places a broad rule in
~/.openclaw/workspace/cleaner.yamlthat matches an intended protected file. - The whitelist contains that file using the documented YAML list syntax.
- Mutation is enabled through
--forceordry_run: false. - The parser retains the list marker and quotes in the whitelist value.
is_whitelistedfails to recognize the ...[truncated 471 chars]
- An attacker or configuration author places a broad rule in
- Remediation
View remediation
Remediation Suggestions
- Replace the ad hoc parser with a maintained YAML parser such as
yq, or parse the configuration in a language with safe YAML support. - If a restricted parser must be retained, explicitly validate YAML structure and remove list markers and matching outer quotes before accepting values.
- Canonicalize both candidate and whitelist paths using
realpathbefore comparison. - Reject relative whitelist entries, malformed values, control characters, and entries outside the expected workspace.
- Parse only the actual whitelist sequence rather than an arbitrary 20-line range.
- Add automated tests proving that documented whitelist entries block both deletion and archival.
- Abort all mutation if configuration or whitelist parsing fails.
- Replace the ad hoc parser with a maintained YAML parser such as