mirror of https://github.com/openclaw/openclaw.git
b7a37c2023
tsx, jiti, ts-node, ts-node-esm, vite-node, and esno were not recognized as interpreter-style script runners in invoke-system-run-plan.ts. These runners produced mutableFileOperand: null, causing invoke-system-run.ts to skip revalidation entirely. A mutated script payload would execute without the approval binding check that node ./run.js already enforced. Two-part fix: - Add tsx, jiti, and related TypeScript/ESM loaders to the known script runner set so they produce a valid mutableFileOperand from the planner - Add a fail-closed runtime guard in invoke-system-run.ts that denies execution when a script run should have a mutable-file binding but the approval plan is missing it, preventing unknown future runners from silently bypassing revalidation Fixes GHSA-qc36-x95h-7j53 |
||
|---|---|---|
| .. | ||
| config.ts | ||
| exec-policy.test.ts | ||
| exec-policy.ts | ||
| invoke-browser.test.ts | ||
| invoke-browser.ts | ||
| invoke-system-run-allowlist.ts | ||
| invoke-system-run-plan.test.ts | ||
| invoke-system-run-plan.ts | ||
| invoke-system-run.test.ts | ||
| invoke-system-run.ts | ||
| invoke-types.ts | ||
| invoke.sanitize-env.test.ts | ||
| invoke.ts | ||
| runner.credentials.test.ts | ||
| runner.ts | ||
| with-timeout.ts | ||