fix(security): bound trusted package URL prefixes

vincentkoc · vincentkoc · commit 12c34fc3a951 · 2026-06-21T13:51:24.000+02:00
diff --git a/scripts/resolve-openclaw-package-candidate.mjs b/scripts/resolve-openclaw-package-candidate.mjs
@@ -890,6 +890,14 @@ function parseTrustedPort(value) {
   return Number.NaN;
 }
 
+function pathnameMatchesTrustedPrefix(pathname, prefix) {
+  if (prefix === "/") {
+    return true;
+  }
+  const normalizedPrefix = prefix.endsWith("/") ? prefix : `${prefix}/`;
+  return pathname === prefix || pathname.startsWith(normalizedPrefix);
+}
+
 function toPathPrefixes(value, sourceId) {
   const prefixes = value === undefined ? ["/"] : value;
   if (!Array.isArray(prefixes) || prefixes.length === 0) {
@@ -981,7 +989,11 @@ function validateTrustedPackageDownloadUrl(parsed, trustedSource, options = {})
       `package_url port ${packageUrlPort(parsed)} is not allowed by trusted package source ${trustedSource.id}`,
     );
   }
-  if (!trustedSource.pathPrefixes.some((prefix) => parsed.pathname.startsWith(prefix))) {
+  if (
+    !trustedSource.pathPrefixes.some((prefix) =>
+      pathnameMatchesTrustedPrefix(parsed.pathname, prefix),
+    )
+  ) {
     throw new Error(
       `package_url path is not allowed by trusted package source ${trustedSource.id}`,
     );
diff --git a/test/scripts/resolve-openclaw-package-candidate.test.ts b/test/scripts/resolve-openclaw-package-candidate.test.ts
@@ -693,7 +693,7 @@ describe("resolve-openclaw-package-candidate", () => {
           status: 200,
         });
       },
-      lookupHost: lookupAddresses([{ address: "10.0.0.8", family: 4 }]),
+      lookupHost: lookupAddresses([{ address: "203.0.113.8", family: 4 }]),
       maxBytes: 3,
       trustedSource,
     });
@@ -713,7 +713,44 @@ describe("resolve-openclaw-package-candidate", () => {
     await expect(
       downloadUrl("https://packages.internal:8443/other/openclaw.tgz", target, {
         fetchImpl: unexpectedFetch,
-        lookupHost: lookupAddresses([{ address: "10.0.0.8", family: 4 }]),
+        lookupHost: lookupAddresses([{ address: "203.0.113.8", family: 4 }]),
+        trustedSource,
+      }),
+    ).rejects.toThrow("path is not allowed by trusted package source enterprise-artifactory");
+  });
+
+  it("matches trusted package_url path prefixes on path segment boundaries", async () => {
+    const dir = await mkdtemp(path.join(tmpdir(), "openclaw-package-download-"));
+    tempDirs.push(dir);
+    const target = path.join(dir, "openclaw.tgz");
+    const trustedSource = {
+      allowPrivateNetwork: true,
+      hosts: ["packages.internal"],
+      id: "enterprise-artifactory",
+      pathPrefixes: ["/artifactory/openclaw"],
+      ports: [8443],
+      redirectHosts: ["packages.internal"],
+    };
+    const requestedUrls: string[] = [];
+
+    await downloadUrl("https://packages.internal:8443/artifactory/openclaw/pkg.tgz", target, {
+      fetchImpl: async (url: URL) => {
+        requestedUrls.push(url.toString());
+        return new Response(new Uint8Array([1, 2, 3]), {
+          headers: { "content-length": "3" },
+          status: 200,
+        });
+      },
+      lookupHost: lookupAddresses([{ address: "203.0.113.8", family: 4 }]),
+      maxBytes: 3,
+      trustedSource,
+    });
+
+    expect(requestedUrls).toEqual(["https://packages.internal:8443/artifactory/openclaw/pkg.tgz"]);
+    await expect(
+      downloadUrl("https://packages.internal:8443/artifactory/openclaw-malicious/pkg.tgz", target, {
+        fetchImpl: unexpectedFetch,
+        lookupHost: lookupAddresses([{ address: "203.0.113.8", family: 4 }]),
         trustedSource,
       }),
     ).rejects.toThrow("path is not allowed by trusted package source enterprise-artifactory");
