T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/advisor.js:184
- Finding
- Broad Access to Private Agent Conversation History<![CDATA[ ## Vulnerability Details **File Location**: `scripts/advisor.js`, lines 16–17 and 184–239 **Vulnerability Type**: Excessive access to sensitive conversation data **Risk Level**: Medium ### Vulnerable Code ```js const SESSIONS_DIR = join(HOME, '.openclaw', 'agents', 'main', 'sessions'); const SESSIONS_META = join(SESSIONS_DIR, 'sessions.json'); /** * 读取最近 N 个 session 的用户消息文本 */ function loadHistoryMessages(maxSessions = 5, maxMsgsPerSession = 50) { if (!existsSync(SESSIONS_DIR)) return []; // 获取活跃 session ID let activeIds = []; if (existsSync(SESSIONS_META)) { try { const meta = JSON.parse(readFileSync(SESSIONS_META, 'utf8')); activeIds = Object.values(meta) .filter(s => s.sessionId) .sort((a, b) => (b.updatedAt ?? 0) - (a.updatedAt ?? 0)) .slice(0, maxSessions) .map(s => s.sessionId); } catch { /* ignore */ } } // 若 sessions.json 没读到，扫描 .jsonl 文件 if (activeIds.length === 0) { try { const files = readdirSync(SESSIONS_DIR) .filter(f => f.endsWith('.jsonl') && !f.includes('.deleted')) .slice(0, maxSessions); activeIds = files.map(f => f.replace('.jsonl', '')); } catch { /* ignore */ } } const messages = []; for (const id of activeIds) { const filePath = join(SESSIONS_DIR, `${id}.jsonl`); if (!existsSync(filePath)) continue; try { const lines = readFileSync(filePath, 'utf8').split('\n'); let count = 0; for (const line of lines) { if (!line.trim()) continue; try { const event = JSON.parse(line); if ( event.type === 'message' && event.message?.role === 'user' && Array.isArray(event.message.content) ) { const text = event.message.content .filter(c => c.type === 'text') .map(c => c.text ?? '') .join(' '); if (text.trim()) { messages.push({ text, timestamp: ...[truncated 2334 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit, informed user consent before accessing conversation history. 2. Keep history access disabled by default and provide a task-description-only recommendation mode as the preferred option. 3. Allow users to select the sessions and date range that may be analyzed. 4. Minimize data collection by processing only the number of messages necessary for recommendation. 5. Prefer precomputed, non-sensitive task classifications or metadata over full message bodies. 6. Avoid retaining extracted message text after classification; aggregate keyword counts immediately and discard each message. 7. Clearly indicate before execution which files and how many messages will be read. 8. Apply strict filesystem permission checks and reject session files that are symbolic links or outside the expected sessions directory. ]]>