T09 · Insecure Skill Coding Practices
- Location
openclaw-index.js:12- Finding
Unbounded Image Decoding and Processing Enables Resource Exhaustion
- Content
View full analysis
Vulnerability Details
File Location:
openclaw-index.js, lines 12–17
Vulnerability Type: Unrestricted resource consumption through unvalidated image input
Risk Level: MediumVulnerable Code
js // Get buffer from input let buf = typeof img === "string" ? Buffer.from(img.split(",").pop(), "base64") : img.data ? Buffer.from(img.data, "base64") : img; // Step 1: Resize to 9:16 aspect ratio const meta = await sharp(buf).metadata(); const targetWidth = meta.width; const targetHeight = Math.floor(meta.width * (16 / 9));Technical Analysis
The handler converts attacker-controlled Base64 content into a memory buffer and passes it to Sharp without validating:
- Encoded or decoded input size
- Image format
- Image dimensions
- Total pixel count
- Image authenticity
- Processing time or memory consumption
A small compressed image can expand into a very large raster representation. In addition, the target output height is calculated directly from attacker-controlled image metadata. Subsequent crop, extension, enhancement, and JPEG-encoding operations create additional buffers, amplifying memory and CPU consumption.
The implementation also lacks local exception handling for malformed or unsupported image data. Consequently, decoding and processing failures propagate from the handler unless the hosting platform provides an external error boundary.
This behavior contradicts the “Input validation” claim in
SKILL.md, as no substantive validation is implemented before decoding or transformation.Attack Path
- An attacker invokes the skill with an oversized Base64 payload, a high-resolution image, or a compressed image with extreme decoded dimensions.
- The handler decodes the entire payload into a Node.js
Buffer. - Sharp reads attacker-controlled metadata and allocates resources to decode the image.
- The handler performs multiple full-image operations, including crop or extension, sharpening, modulation, blur, gamma correctio ...[truncated 897 chars]
- Remediation
View remediation
Remediation Suggestions
- Enforce a strict request-body and encoded Base64 size limit before decoding.
- Validate the Base64 syntax and reject malformed input instead of permissively decoding arbitrary strings.
- Enforce a strict decoded-buffer size limit.
- Configure Sharp with an explicit input pixel limit appropriate for the deployment.
- Read metadata and reject images whose width, height, or total pixel count exceeds documented limits.
- Allowlist required input formats, such as JPEG, PNG, and WebP, and reject unsupported formats.
- Validate that metadata contains finite, positive integer dimensions before calculating target dimensions.
- Limit output dimensions and reject inputs that would produce an excessive 9:16 canvas.
- Wrap decoding and transformation operations in
try/catchblocks and return controlled client errors for malformed or oversized images. - Apply platform-level memory limits, execution timeouts, concurrency limits, and rate limiting.
- Consider processing untrusted images in an isolated worker with restricted resources.
- Update
SKILL.mdto document the actual accepted formats and enforced size, dimension, and pixel-count limits.