fix(gateway): validate exact custom browser origins (#38290)

brunowowk · steipete · web-flow · commit fa0349aa440b · 2026-07-09T12:41:53.000+01:00
Co-authored-by: Peter Steinberger &lt;steipete@gmail.com&gt;
diff --git a/src/gateway/origin-check.test.ts b/src/gateway/origin-check.test.ts
@@ -144,4 +144,33 @@ describe("checkBrowserOrigin", () => {
   ])("$name", ({ input, expected }) => {
     expect(checkBrowserOrigin(input)).toEqual(expected);
   });
+
+  it.each([
+    "chrome-extension://abcdefghijklmnop",
+    "tauri://localhost",
+    "electron://localhost",
+    "app://desktop",
+  ])("accepts an exactly allowlisted hosted app origin: %s", (origin) => {
+    expect(checkBrowserOrigin({ origin, allowedOrigins: [origin] })).toEqual({
+      ok: true,
+      matchedBy: "allowlist",
+    });
+  });
+
+  it.each([
+    "tauri://localhost/path",
+    "tauri://localhost/admin/..",
+    "tauri://localhost/%2e",
+    "https://control.example.com\\admin",
+    "tauri://localhost?mode=admin",
+    "tauri://localhost#admin",
+    "tauri://user@localhost",
+    "file:///tmp/openclaw.html",
+    "data:text/plain,hello",
+  ])("rejects a non-origin URL value: %s", (origin) => {
+    expect(checkBrowserOrigin({ origin, allowedOrigins: [origin] })).toEqual({
+      ok: false,
+      reason: "origin missing or invalid",
+    });
+  });
 });
diff --git a/src/gateway/origin-check.ts b/src/gateway/origin-check.ts
@@ -21,10 +21,20 @@ function parseOrigin(
   if (!trimmed || trimmed === "null") {
     return null;
   }
+  // URL parsing collapses dot segments. Reject non-origin suffixes before
+  // canonicalization so a path cannot inherit its authority's grant.
+  if (!/^[a-z][a-z0-9+.-]*:\/\/[^/?#\\]+\/?$/i.test(trimmed)) {
+    return null;
+  }
   try {
     const url = new URL(trimmed);
+    if (url.username || url.password || !url.protocol || !url.host) {
+      return null;
+    }
+    // Hosted app schemes have an opaque URL.origin but a stable authority.
+    const origin = url.origin === "null" ? `${url.protocol}//${url.host}` : url.origin;
     return {
-      origin: normalizeLowercaseStringOrEmpty(url.origin),
+      origin: normalizeLowercaseStringOrEmpty(origin),
       host: normalizeLowercaseStringOrEmpty(url.host),
       hostname: normalizeLowercaseStringOrEmpty(url.hostname),
     };
diff --git a/src/gateway/server.auth.browser-hardening.test.ts b/src/gateway/server.auth.browser-hardening.test.ts
@@ -308,6 +308,28 @@ describe("gateway auth browser hardening", () => {
     });
   });
 
+  test("accepts an exactly allowlisted Tauri origin", async () => {
+    const { writeConfigFile } = await import("../config/config.js");
+    const origin = "tauri://localhost";
+    testState.gatewayAuth = { mode: "token", token: "secret" };
+    await writeConfigFile({ gateway: { controlUi: { allowedOrigins: [origin] } } });
+
+    await withGatewayServer(async ({ port }) => {
+      const ws = await openWs(port, { origin });
+      try {
+        const res = await connectReq(ws, {
+          token: "secret",
+          client: TEST_OPERATOR_CLIENT,
+          device: null,
+        });
+        expect(res.ok).toBe(true);
+        expect((res.payload as { type?: string } | undefined)?.type).toBe("hello-ok");
+      } finally {
+        ws.close();
+      }
+    });
+  });
+
   test("rejects non-local browser origins for non-control-ui clients", async () => {
     await expectBrowserOriginConnectRejected({});
   });
