fix(security): restrict wildcard HTTP methods in network policies by WuKongAI-CMU · Pull Request #1115 · NVIDIA/NemoClaw

WuKongAI-CMU · 2026-03-30T18:15:57Z

Summary

Replace method: "*" wildcards with explicit method+path allowlists for all inference and telemetry endpoints in openclaw-sandbox.yaml
Add missing protocol: rest and enforcement: enforce to statsig.anthropic.com and sentry.io entries (rules existed but L7 inspection was never activated)
Add regression tests preventing future wildcard method rules and ensuring all rule-bearing endpoints have L7 enforcement enabled

Why

The policy file's own header states: "deny by default, allow only what's needed." Wildcard methods contradict this by permitting DELETE/PUT/PATCH to management APIs that share hosts with inference endpoints:

Host	Risk	Now restricted to
`api.anthropic.com`	`DELETE /v1/files/`, `DELETE /v1/skills/`	`POST` to `/v1/messages`, `/v1/complete`
`integrate.api.nvidia.com`	`DELETE /v2/nvcf/deployments/**`	`POST` completions/embeddings, `GET` models
`inference-api.nvidia.com`	Same NVIDIA Cloud Functions risk	`POST` completions, `GET` models
`statsig.anthropic.com`	Rules existed but no L7 enforcement	`POST` only, L7 now enforced
`sentry.io`	`DELETE /api/0/projects/**`	`POST` to ingest paths only, L7 now enforced

Test plan

npx vitest run test/validate-blueprint.test.ts — 24 tests pass (2 new)
npm test — full suite 638 passed, 0 failed
Manual: verify inference still works through the restricted paths (POST to /v1/chat/completions)
Manual: verify telemetry (Sentry/Statsig) still reports through POST-only rules

Fixes #1113

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Tightened external network access by replacing broad wildcard allowances with explicit method/path allowlists for third-party APIs (Anthropic, Statsig, Sentry, NVIDIA) and added endpoint metadata to improve security and reduce exposure.
Tests
- Added validation checks to ensure no wildcard methods remain, endpoints declare protocol/enforcement, and NVIDIA endpoints include required API rules.

Signed-off-by: Charan Jagwani [email protected]

coderabbitai · 2026-03-30T18:16:11Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: e3c60d5f-38e4-4ced-b07c-b885cba184c2

📥 Commits

Reviewing files that changed from the base of the PR and between 401cfd0 and 17ca6d5.

📒 Files selected for processing (1)

nemoclaw-blueprint/policies/openclaw-sandbox.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

nemoclaw-blueprint/policies/openclaw-sandbox.yaml

📝 Walkthrough

Walkthrough

Narrowed network policy allow rules in the sandbox: replaced wildcard HTTP method/path rules with explicit REST allowlists for Anthropic (api.anthropic.com, statsig.anthropic.com), Sentry (sentry.io), and NVIDIA (integrate.api.nvidia.com, inference-api.nvidia.com); added tests validating no wildcard methods, L7 enforcement, and NVIDIA embedding POST rules.

Changes

Cohort / File(s)	Summary
OpenClaw sandbox policy `nemoclaw-blueprint/policies/openclaw-sandbox.yaml`	Replaced wildcard `method: ""` / `path: "/"` rules with explicit REST allowlists: Anthropic `api.anthropic.com` limited to `POST /v1/messages`, `POST /v1/messages/batches`, `GET /v1/messages/batches/`, `POST /v1/complete`; `statsig.anthropic.com` had `GET "/"` removed, retaining POST-only; `sentry.io` restricted to `POST /api//envelope/*` and `POST /api//store/`. NVIDIA endpoints (`integrate.api.nvidia.com`, `inference-api.nvidia.com`) tightened to explicit `POST /v1/chat/completions`, `POST /v1/completions`, `POST /v1/embeddings` and `GET /v1/models` (+ `GET /v1/models/`); ensured `protocol: rest` and `enforcement: enforce` where applicable.
Policy validation tests `test/validate-blueprint.test.ts`	Added three tests: (1) assert no rule uses wildcard method `"*"`, (2) assert endpoints that declare `rules` also set `protocol: "rest"` and `enforcement: "enforce"`, (3) assert NVIDIA endpoints include a `POST /v1/embeddings` rule for both integrate/inference hosts.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐇
I hop through lines of tightened code,
Swapping wild winds for doors with locks,
POSTs and GETs march in tidy flocks,
No rogue DELETEs nibble our load,
I twitch my whiskers — safe paths now bode.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix(security): restrict wildcard HTTP methods in network policies' accurately and concisely summarizes the main change: replacing wildcard HTTP method rules with explicit allowlists.
Linked Issues check	✅ Passed	All coding requirements from `#1113` are met: wildcard method rules replaced with explicit allowlists, protocol/enforcement added for statsig and sentry, and regression tests added to prevent reintroduction.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to addressing wildcard HTTP methods in network policies (`#1113`). Modifications to openclaw-sandbox.yaml and regression tests in validate-blueprint.test.ts are aligned with the stated objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@nemoclaw-blueprint/policies/openclaw-sandbox.yaml`:
- Around line 97-101: The rules block is missing the POST /v1/embeddings entry
for the inference-api.nvidia.com sandbox; add a new rule item matching the style
of the others: - allow: { method: POST, path: "/v1/embeddings" } alongside the
existing - allow: { method: POST, path: "/v1/chat/completions" } and - allow: {
method: POST, path: "/v1/completions" } entries so both NVIDIA endpoints support
embeddings and completions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 35d38c81-9626-4c67-bd36-35a8c7dee8ae

📥 Commits

Reviewing files that changed from the base of the PR and between 052c86c and 9f6c106.

📒 Files selected for processing (2)

nemoclaw-blueprint/policies/openclaw-sandbox.yaml
test/validate-blueprint.test.ts

wscurran · 2026-03-30T19:21:05Z

✨ Thanks for submitting this PR with a detailed summary, it addresses a security bug with wildcard HTTP methods and proposes a fix to improve the security of NemoClaw, which could prevent potential vulnerabilities.

Replace method: "*" wildcards with explicit method+path allowlists for inference and telemetry endpoints. A wildcard permits DELETE/PUT/PATCH to management APIs (NVIDIA Cloud Functions, Anthropic files/skills, Sentry projects) that share the same host as inference endpoints. Changes: - api.anthropic.com: POST /v1/messages, /v1/messages/batches, /v1/complete - integrate.api.nvidia.com: POST chat/completions/embeddings + GET models - inference-api.nvidia.com: POST completions + GET models - statsig.anthropic.com: add protocol: rest + enforcement: enforce, POST only - sentry.io: add protocol: rest + enforcement: enforce, POST to ingest paths Adds regression tests ensuring no endpoint uses wildcard methods and all rule-bearing endpoints have protocol: rest + enforcement: enforce. Fixes NVIDIA#1113

Signed-off-by: peteryuqin <[email protected]>

WuKongAI-CMU · 2026-04-02T06:50:21Z

Rebased this branch onto current main and kept the restrictive allowlist intent intact. Also added the missing POST /v1/embeddings rule for inference-api.nvidia.com that came up in review. Verification run: npm test -- test/validate-blueprint.test.ts.

cjagwani · 2026-04-02T15:33:27Z

Tests pass locally. One note: the wildcard-method regression test
catches method: "*" but doesn't cover wildcard paths other policy groups still use path: "/**" with explicit GET/POST.

cjagwani · 2026-04-02T16:36:48Z

Hey @WuKongAI-CMU! The only failing check is DCO (Developer Certificate of Origin) meaning your commits need a Signed-off-by line. You can fix it with:

git rebase --signoff HEAD~3
git push --force-with-lease
Everything else passes.

Signed-off-by: Charan Jagwani <[email protected]>

…IDIA#1115) ## Summary - Replace `method: "*"` wildcards with explicit method+path allowlists for all inference and telemetry endpoints in `openclaw-sandbox.yaml` - Add missing `protocol: rest` and `enforcement: enforce` to `statsig.anthropic.com` and `sentry.io` entries (rules existed but L7 inspection was never activated) - Add regression tests preventing future wildcard method rules and ensuring all rule-bearing endpoints have L7 enforcement enabled ## Why The policy file's own header states: *"deny by default, allow only what's needed."* Wildcard methods contradict this by permitting `DELETE`/`PUT`/`PATCH` to management APIs that share hosts with inference endpoints: | Host | Risk | Now restricted to | |------|------|-------------------| | `api.anthropic.com` | `DELETE /v1/files/*`, `DELETE /v1/skills/*` | `POST` to `/v1/messages`, `/v1/complete` | | `integrate.api.nvidia.com` | `DELETE /v2/nvcf/deployments/**` | `POST` completions/embeddings, `GET` models | | `inference-api.nvidia.com` | Same NVIDIA Cloud Functions risk | `POST` completions, `GET` models | | `statsig.anthropic.com` | Rules existed but no L7 enforcement | `POST` only, L7 now enforced | | `sentry.io` | `DELETE /api/0/projects/**` | `POST` to ingest paths only, L7 now enforced | ## Test plan - [x] `npx vitest run test/validate-blueprint.test.ts` — 24 tests pass (2 new) - [x] `npm test` — full suite 638 passed, 0 failed - [ ] Manual: verify inference still works through the restricted paths (POST to `/v1/chat/completions`) - [ ] Manual: verify telemetry (Sentry/Statsig) still reports through POST-only rules Fixes NVIDIA#1113 🤖 Generated with [Claude Code](https://claude.com/claude-code)  ## Summary by CodeRabbit * **Chores** * Tightened external network access by replacing broad wildcard allowances with explicit method/path allowlists for third-party APIs (Anthropic, Statsig, Sentry, NVIDIA) and added endpoint metadata to improve security and reduce exposure. * **Tests** * Added validation checks to ensure no wildcard methods remain, endpoints declare protocol/enforcement, and NVIDIA endpoints include required API rules.  Signed-off-by: Charan Jagwani <[email protected]> --------- Signed-off-by: peteryuqin <[email protected]> Signed-off-by: Charan Jagwani <[email protected]> Co-authored-by: cjagwani <[email protected]>

WuKongAI-CMU mentioned this pull request Mar 30, 2026

GitHub network policy should use protocol: rest to enable scoped method/path controls #1111

Closed

coderabbitai Bot reviewed Mar 30, 2026

View reviewed changes

Comment thread nemoclaw-blueprint/policies/openclaw-sandbox.yaml

wscurran added security Potential vulnerability, unsafe behavior, or access risk priority: high labels Mar 30, 2026

cjagwani self-assigned this Apr 1, 2026

WuKongAI-CMU added 2 commits April 2, 2026 00:27

fix(policy): allow embeddings on inference-api host

eb5d7cb

Signed-off-by: peteryuqin <[email protected]>

WuKongAI-CMU force-pushed the fix/1113-restrict-policy-methods branch from e4cf7a8 to eb5d7cb Compare April 2, 2026 04:28

Merge branch 'main' into fix/1113-restrict-policy-methods

4dbc2da

cjagwani closed this Apr 2, 2026

cjagwani reopened this Apr 2, 2026

cjagwani added 3 commits April 2, 2026 10:10

chore: add DCO sign-off

aa36243

Signed-off-by: Charan Jagwani <[email protected]>

Merge branch 'main' into fix/1113-restrict-policy-methods

401cfd0

Merge branch 'main' into fix/1113-restrict-policy-methods

40c841b

cjagwani requested review from cv and ericksoa April 6, 2026 16:09

This was referenced Apr 6, 2026

test(security): harden policy regression tests with method allowlist and coverage gaps #1541

Closed

fix(security): restrict remaining access: full endpoints with L7 inspection #1542

Closed

Merge branch 'main' into fix/1113-restrict-policy-methods

17ca6d5

cjagwani requested a review from brandonpelfrey April 7, 2026 14:34

brandonpelfrey approved these changes Apr 7, 2026

View reviewed changes

brandonpelfrey merged commit 6c300b3 into NVIDIA:main Apr 7, 2026
10 checks passed

brandonpelfrey self-assigned this Apr 7, 2026

wscurran added bug-fix PR fixes a bug or regression and removed priority: high labels Jun 3, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(security): restrict wildcard HTTP methods in network policies#1115

fix(security): restrict wildcard HTTP methods in network policies#1115
brandonpelfrey merged 7 commits into
NVIDIA:mainfrom
WuKongAI-CMU:fix/1113-restrict-policy-methods

WuKongAI-CMU commented Mar 30, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Mar 30, 2026 •

edited

Loading

Reviews paused

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

wscurran commented Mar 30, 2026

Uh oh!

WuKongAI-CMU commented Apr 2, 2026

Uh oh!

cjagwani commented Apr 2, 2026

Uh oh!

cjagwani commented Apr 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

WuKongAI-CMU commented Mar 30, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

wscurran commented Mar 30, 2026

Uh oh!

WuKongAI-CMU commented Apr 2, 2026

Uh oh!

cjagwani commented Apr 2, 2026

Uh oh!

cjagwani commented Apr 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

WuKongAI-CMU commented Mar 30, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Mar 30, 2026 •

edited

Loading