T09 · Insecure Skill Coding Practices
Error
- Location
index.ts:388- Finding
Gateway RPC Accepts an Unrestricted Transcript File Path
- Content
View full analysis
{ try { const { sessionFile } = params; if (!sessionFile || !fs.existsSync(sessionFile)) { respond(true, { error: 'Session file not found', messages: 0, tokens: 0 }); return; } const entries = readTranscript(sessionFile); const messages = extractMessages(entries); const totalTokens = messages.reduce( (sum, m) => sum + estimateTokens(m.content, charsPerToken), 0 ); respond(true, { messages: messages.length, tokens: totalTokens, maxTokens, needsCompaction: totalTokens > maxTokens, cacheSize: summaryCache.size, }); ``` The invoked transcript reader performs a synchronous read of the supplied path: ```ts function readTranscript(sessionPath: string): SessionEntry[] { if (!fs.existsSync(sessionPath)) return []; const content = fs.readFileSync(sessionPath, 'utf8'); const lines = content.trim().split('\n').filter(Boolean); return lines.map(line => { try { return JSON.parse(line); } catch { return null; } }).filter(Boolean) as SessionEntry[]; } ``` ### Technical Analysis The gateway method takes `params.sessionFile` from its caller and passes it directly to `fs.existsSync` and `fs.readFileSync`. It does not resolve the path from a trusted session identifier, canonicalize it, restrict it to an approved transcript directory, reject symlinks, verify that it is a regular file, or limit its size. No authorization check for this gateway method is visible in the project. If an untrusted or insufficiently privileged client can invoke the method, it can cause the OpenClaw process to access any path readable with the process's filesystem privileges ...[truncated 1770 chars]- Remediation
View remediation