T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
src/index.js:69- Finding
Unnecessary Loading of Sensitive Session and Environment Data
- Content
View full analysis
f.endsWith('.json')); sessionCount = sessions.length; sessions.forEach(session => { const filePath = path.join(sessionsPath, session); const stats = fs.statSync(filePath); sessionSize += stats.size; try { const content = fs.readFileSync(filePath, 'utf-8'); const lines = content.split('\n').length; if (lines > CONFIG.maxContextLines) { largeSessions.push({ name: session, lines }); } } catch (e) {} }); } ``` The configuration analysis also loads complete `.env` values: ```javascript const configPaths = [ path.join(PATHS.openclaw, 'openclaw.json'), path.join(PATHS.openclaw, 'config.json'), path.join(PATHS.workspace, 'openclaw.json'), path.join(PATHS.workspace, '.env'), ]; configPaths.forEach(configPath => { if (fs.existsSync(configPath)) { try { const content = fs.readFileSync(configPath, 'utf-8'); let config = {}; if (configPath.endsWith('.json')) { config = JSON.parse(content); } else if (configPath.endsWith('.env')) { content.split('\n').forEach(line => { const [key, value] = line.split('='); if (key && value) { config[key.trim()] = value.trim(); } }); } ``` ### Technical Analysis The diagnostic only needs session line counts and configuration key names. Nevertheless, it reads complete session files and parses complete `.env` values into process memory. Session histories may contain private conversations, credentials, tool results, and operational data. Environment files commonly contain API tokens, database passwords, and other secrets. Loading those values increases the a ...[truncated 1362 chars]- Remediation
View remediation