fix(workboard): refuse unsafe SSHFS SQLite storage

vincentkoc · vincentkoc · commit 00160ea6ee22 · 2026-06-16T04:34:14.000+02:00
Preserve rollback journaling for NFS and SMB-backed stores, refuse SSHFS after symlink-aware mount classification, and close Workboard database handles when filesystem policy rejects initialization.
diff --git a/extensions/workboard/src/sqlite-store-policy.test.ts b/extensions/workboard/src/sqlite-store-policy.test.ts
@@ -0,0 +1,42 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const { close, configureSqliteConnectionPragmas } = vi.hoisted(() => ({
+  close: vi.fn(),
+  configureSqliteConnectionPragmas: vi.fn(),
+}));
+
+vi.mock("node:sqlite", () => ({
+  DatabaseSync: vi.fn(function DatabaseSync() {
+    return { close };
+  }),
+}));
+vi.mock("openclaw/plugin-sdk/plugin-state-runtime", () => ({
+  configureSqliteConnectionPragmas,
+}));
+
+import { createWorkboardSqliteStores } from "./sqlite-store.js";
+
+describe("Workboard SQLite policy", () => {
+  beforeEach(() => {
+    close.mockClear();
+    configureSqliteConnectionPragmas.mockReset();
+  });
+
+  it("closes a newly opened database when filesystem policy refuses it", () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-workboard-policy-"));
+    const dbPath = path.join(dir, "workboard.sqlite");
+    configureSqliteConnectionPragmas.mockImplementation(() => {
+      throw new Error("SSHFS is unsupported");
+    });
+
+    try {
+      expect(() => createWorkboardSqliteStores({ dbPath })).toThrow(/SSHFS/);
+      expect(close).toHaveBeenCalledTimes(1);
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/extensions/workboard/src/sqlite-store.ts b/extensions/workboard/src/sqlite-store.ts
@@ -390,17 +390,27 @@ function createDatabase(dbPath: string): {
     fs.closeSync(fs.openSync(dbPath, "a", WORKBOARD_SQLITE_FILE_MODE));
   }
   const db = new DatabaseSync(dbPath);
-  const maintenance = configureSqliteConnectionPragmas(db, {
-    busyTimeoutMs: WORKBOARD_SQLITE_BUSY_TIMEOUT_MS,
-    checkpointIntervalMs: 0,
-    databaseLabel: "workboard database",
-    databasePath: dbPath,
-    foreignKeys: true,
-    synchronous: "NORMAL",
-  });
-  ensureWorkboardSchema(db);
-  hardenWorkboardDatabaseFiles(dbPath);
-  return { db, maintenance };
+  let maintenance: ReturnType<typeof configureSqliteConnectionPragmas> | undefined;
+  try {
+    maintenance = configureSqliteConnectionPragmas(db, {
+      busyTimeoutMs: WORKBOARD_SQLITE_BUSY_TIMEOUT_MS,
+      checkpointIntervalMs: 0,
+      databaseLabel: "workboard database",
+      databasePath: dbPath,
+      foreignKeys: true,
+      synchronous: "NORMAL",
+    });
+    ensureWorkboardSchema(db);
+    hardenWorkboardDatabaseFiles(dbPath);
+    return { db, maintenance };
+  } catch (error) {
+    try {
+      maintenance?.close();
+    } finally {
+      db.close();
+    }
+    throw error;
+  }
 }
 
 function childRows(db: DatabaseSync, table: string, cardId: string): Row[] {
diff --git a/src/infra/sqlite-wal.test.ts b/src/infra/sqlite-wal.test.ts
@@ -204,6 +204,82 @@ describe("sqlite WAL maintenance", () => {
     }
   });
 
+  it("refuses fuse.sshfs mountinfo entries", () => {
+    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-sqlite-sshfs-"));
+    try {
+      const db = createMockDb();
+      vi.spyOn(fs, "statfsSync").mockReturnValue(statfsFixture(0));
+      vi.spyOn(fs, "readFileSync").mockReturnValue(
+        `42 12 0:41 / ${tempDir} rw,relatime - fuse.sshfs user@host:/share rw\n`,
+      );
+
+      expect(() =>
+        configureSqliteWalMaintenance(db, {
+          checkpointIntervalMs: 0,
+          databaseLabel: "test-db",
+          databasePath: path.join(tempDir, "openclaw.sqlite"),
+        }),
+      ).toThrow(/test-db .*SSHFS.*refusing to open/);
+
+      expect(db["prepare"]).not.toHaveBeenCalled();
+      expect(db["exec"]).not.toHaveBeenCalled();
+    } finally {
+      fs.rmSync(tempDir, { recursive: true, force: true });
+    }
+  });
+
+  it("refuses symlinked paths into fuse.sshfs mounts", () => {
+    if (process.platform === "win32") {
+      return;
+    }
+    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-sqlite-sshfs-link-"));
+    const mountDir = path.join(tempDir, "mount");
+    const linkedDir = path.join(tempDir, "linked");
+    try {
+      fs.mkdirSync(mountDir);
+      fs.symlinkSync(mountDir, linkedDir);
+      vi.spyOn(fs, "statfsSync").mockReturnValue(statfsFixture(0));
+      vi.spyOn(fs, "readFileSync").mockReturnValue(
+        `42 12 0:41 / ${mountDir} rw,relatime - fuse.sshfs user@host:/share rw\n`,
+      );
+
+      expect(() =>
+        configureSqliteWalMaintenance(createMockDb(), {
+          checkpointIntervalMs: 0,
+          databasePath: path.join(linkedDir, "openclaw.sqlite"),
+        }),
+      ).toThrow(/SSHFS.*refusing to open/);
+    } finally {
+      fs.rmSync(tempDir, { recursive: true, force: true });
+    }
+  });
+
+  it("matches raw mount paths when the existing path canonicalizes elsewhere", () => {
+    if (process.platform === "win32") {
+      return;
+    }
+    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-sqlite-sshfs-prefix-"));
+    const canonicalMountDir = path.join(tempDir, "canonical-mount");
+    const rawMountDir = path.join(tempDir, "raw-mount");
+    try {
+      fs.mkdirSync(canonicalMountDir);
+      fs.symlinkSync(canonicalMountDir, rawMountDir);
+      vi.spyOn(fs, "statfsSync").mockReturnValue(statfsFixture(0));
+      vi.spyOn(fs, "readFileSync").mockReturnValue(
+        `42 12 0:41 / ${rawMountDir} rw,relatime - fuse.sshfs user@host:/share rw\n`,
+      );
+
+      expect(() =>
+        configureSqliteWalMaintenance(createMockDb(), {
+          checkpointIntervalMs: 0,
+          databasePath: path.join(rawMountDir, "openclaw.sqlite"),
+        }),
+      ).toThrow(/SSHFS.*refusing to open/);
+    } finally {
+      fs.rmSync(tempDir, { recursive: true, force: true });
+    }
+  });
+
   it("uses mount command filesystem names on platforms without proc mountinfo", () => {
     const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-sqlite-nfs-"));
     try {
@@ -250,6 +326,60 @@ describe("sqlite WAL maintenance", () => {
     }
   });
 
+  it.each([
+    ["macfuse", "sshfs#user@host:/share"],
+    ["macfuse", "host:/share"],
+    ["macfuse", "user@host:"],
+    ["osxfuse", "user@host:/share"],
+    ["osxfuse", "sshfs@osxfuse0"],
+  ])("refuses SSHFS reported as %s by mount", (fsType, source) => {
+    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-sqlite-sshfs-macfuse-"));
+    try {
+      const db = createMockDb();
+      vi.spyOn(fs, "statfsSync").mockReturnValue(statfsFixture(0));
+      vi.spyOn(fs, "readFileSync").mockImplementation(() => {
+        throw new Error("no proc mountinfo");
+      });
+      vi.spyOn(childProcess, "execFileSync").mockReturnValue(
+        Buffer.from(`${source} on ${tempDir} (${fsType}, nodev, nosuid)\n`),
+      );
+
+      expect(() =>
+        configureSqliteWalMaintenance(db, {
+          checkpointIntervalMs: 0,
+          databasePath: path.join(tempDir, "openclaw.sqlite"),
+        }),
+      ).toThrow(/refusing to open/);
+
+      expect(db["exec"]).not.toHaveBeenCalled();
+    } finally {
+      fs.rmSync(tempDir, { recursive: true, force: true });
+    }
+  });
+
+  it("keeps WAL enabled for non-remote macFUSE mounts", () => {
+    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-sqlite-macfuse-"));
+    try {
+      const db = createMockDb();
+      vi.spyOn(fs, "statfsSync").mockReturnValue(statfsFixture(0));
+      vi.spyOn(fs, "readFileSync").mockImplementation(() => {
+        throw new Error("no proc mountinfo");
+      });
+      vi.spyOn(childProcess, "execFileSync").mockReturnValue(
+        Buffer.from(`remote-volume on ${tempDir} (macfuse, nodev, nosuid)\n`),
+      );
+
+      configureSqliteWalMaintenance(db, {
+        checkpointIntervalMs: 0,
+        databasePath: path.join(tempDir, "openclaw.sqlite"),
+      });
+
+      expect(db["exec"]).toHaveBeenNthCalledWith(1, "PRAGMA journal_mode = WAL;");
+    } finally {
+      fs.rmSync(tempDir, { recursive: true, force: true });
+    }
+  });
+
   it("parses Linux mount command filesystem names when proc mountinfo is unavailable", () => {
     const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-sqlite-nfs-"));
     try {
diff --git a/src/infra/sqlite-wal.ts b/src/infra/sqlite-wal.ts
