T05 · Unauthorized Access and Privilege Escalation
Error
- Location
lib/session-guard.js:68- Finding
Automatic Startup Logic Mutates and Resets Global OpenClaw Sessions
- Content
View full analysis
maxTokens) { log(`session-guard: ${key} overflow detected — ${estTokens} est tokens > ${maxTokens} max (file: ${(stat.size / 1024 / 1024).toFixed(1)} MB)`); // Back up the session file const ts = new Date().toISOString().replace(/[:.]/g, "-"); const bakPath = sessionFile.replace(/\.jsonl$/, `.overflow-${ts}.bak`); try { fs.renameSync(sessionFile, bakPath); log(`session-guard: backed up to ${path.basename(bakPath)}`); } catch (e) { log(`session-guard: backup failed: ${e.message}`); continue; } // Reset session entry delete entry.sessionId; delete entry.sessionFile; delete entry.inputTokens; delete entry.outputTokens; delete entry.totalTokens; delete entry.systemSent; modified = true; result.reset.push(key); // Write alert try { const alertDir = path.dirname(ALERT_FILE); if (!fs.existsSync(alertDir)) fs.mkdirSync(alertDir, { recursive: true }); fs.writeFileSync( ALERT_FILE, `Session ${key} auto-reset at ${new Date().toISOString()} (${estTokens} est tokens > ${maxTokens} cap).\n` ); } catch {} } if (modified) { try { fs.writeFileSync(SESSIONS_FILE, JSON.stringify(sessions, null, 2)); log(`session-guard: sessions.json updated (${result.reset.length} sessions reset)`); } catch (e) { log(`session-guard: failed to write sessions.json: ${e.message}`); } } ``` The operation is automatically invoked during service startup: ```js const guard = checkSessionHealth({ threshold: cfg.sessionOverflowThreshold || 0.8, log: (m) => log.info(m) }); if (guard.reset.length > 0) { log.warn(`Session overflow: ${guard.reset.join(", ")} auto-reset`); } ``` ### Technical Analysis The memory plugin reads the glo ...[truncated 3219 chars]- Remediation
View remediation