T09 · Insecure Skill Coding Practices
- Location
scripts/switch.py:58- Finding
Unrelated Session Transcript May Be Captured During Window Switching
- Content
View full analysis
Vulnerability Details
File Location:
scripts/switch.py, lines 58–75 and 92–96
Vulnerability Type: Cross-session data exposure caused by insecure session selection
Risk Level: HighVulnerable Code
python def get_latest_session_path(): """获取最新活跃的 session jsonl 文件""" if not os.path.exists(SESSIONS_DIR): return None sessions = [] for f in os.listdir(SESSIONS_DIR): if f.endswith(".jsonl") and not f.endswith(".deleted") and not f.endswith(".reset"): path = os.path.join(SESSIONS_DIR, f) mtime = os.path.getmtime(path) sessions.append((mtime, path)) if not sessions: return None # 返回最新的 session sessions.sort(reverse=True) return sessions[0][1]python # 获取最新 session session_path = get_latest_session_path() if session_path: dest_path = os.path.join(output_dir, "transcript.jsonl") shutil.copy2(session_path, dest_path)Technical Analysis
The code identifies the current session by selecting the JSONL file with the most recent modification time. File modification time is not a reliable session-identity or authorization mechanism.
The current window is not bound to an authoritative runtime session identifier before its transcript is copied. If another agent, session, or background process modifies a different transcript more recently, that unrelated transcript becomes the selected source. The implementation then copies it into the current window without checking that it belongs to the active session.
This behavior undermines the documented context-isolation property and can cause one session's conversation history to be persisted and displayed in another window.
Attack Path
- A user has a work window selected through
current.json. - Another session transcript under
~/.openclaw/agents/main/sessionsis created or updated after the intended session transcript. - The user invokes the window-switch operation.
...[truncated 1163 chars]
- A user has a work window selected through
- Remediation
View remediation
Remediation Suggestions
- Bind every window to the authoritative session identifier supplied by the runtime.
- Persist the exact session identifier in
current.jsonand the window metadata. - Resolve the transcript only from that identifier instead of scanning files by modification time.
- Before copying, verify that the resolved transcript belongs to the expected session and is located inside the canonical sessions directory.
- Reject the save operation if the session identifier is absent, malformed, unknown, or inconsistent with the active runtime session.
- Use canonical path validation and disallow symbolic-link sources where feasible.
- Add tests involving multiple concurrently updated session files to confirm that only the explicitly bound session can be copied.
- Avoid displaying historical messages automatically unless the user has explicitly requested restoration and the transcript association has been verified.