Gateway: enforce origin checks for browser-context WS clients#23352
Closed
bmendonca3 wants to merge 2 commits into
Closed
Gateway: enforce origin checks for browser-context WS clients#23352bmendonca3 wants to merge 2 commits into
bmendonca3 wants to merge 2 commits into
Conversation
Contributor
Author
|
Closing temporarily per request for state reset. |
Contributor
Author
|
Reopening per request after validation. |
openclaw-barnacle
Bot
added
docs
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Comment on lines
+72
to
+77
| it("enforces origin checks for UI mode without Origin", () => { | ||
| const result = shouldCheckBrowserOrigin({ | ||
| clientMode: GATEWAY_CLIENT_MODES.UI, | ||
| }); | ||
| expect(result).toBe(true); | ||
| }); |
Contributor
There was a problem hiding this comment.
missing test for WEBCHAT mode
shouldCheckBrowserOrigin enforces checks for both UI and WEBCHAT modes (origin-check.ts:63), but only UI mode is tested here. Add test coverage for WEBCHAT mode enforcement.
Suggested change
| it("enforces origin checks for UI mode without Origin", () => { | |
| const result = shouldCheckBrowserOrigin({ | |
| clientMode: GATEWAY_CLIENT_MODES.UI, | |
| }); | |
| expect(result).toBe(true); | |
| }); | |
| it("enforces origin checks for UI mode without Origin", () => { | |
| const result = shouldCheckBrowserOrigin({ | |
| clientMode: GATEWAY_CLIENT_MODES.UI, | |
| }); | |
| expect(result).toBe(true); | |
| }); | |
| it("enforces origin checks for WEBCHAT mode without Origin", () => { | |
| const result = shouldCheckBrowserOrigin({ | |
| clientMode: GATEWAY_CLIENT_MODES.WEBCHAT, | |
| }); | |
| expect(result).toBe(true); | |
| }); |
Prompt To Fix With AI
This is a comment left during a code review.
Path: src/gateway/origin-check.test.ts
Line: 72-77
Comment:
missing test for `WEBCHAT` mode
`shouldCheckBrowserOrigin` enforces checks for both `UI` and `WEBCHAT` modes (origin-check.ts:63), but only `UI` mode is tested here. Add test coverage for `WEBCHAT` mode enforcement.
```suggestion
it("enforces origin checks for UI mode without Origin", () => {
const result = shouldCheckBrowserOrigin({
clientMode: GATEWAY_CLIENT_MODES.UI,
});
expect(result).toBe(true);
});
it("enforces origin checks for WEBCHAT mode without Origin", () => {
const result = shouldCheckBrowserOrigin({
clientMode: GATEWAY_CLIENT_MODES.WEBCHAT,
});
expect(result).toBe(true);
});
```
How can I resolve this? If you propose a fix, please make it concise.
openclaw-barnacle
Bot
added
size: S
and removed
docs
Member
|
you have been detected be spamming with unwarranted prs and issues and your issues and prs have been automatically closed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Originheader or declares a browser client mode (ui/webchat)origin not allowederror for other clientsOriginmissing,null, mismatched, and matching-host casesTesting
Greptile Summary
This PR enhances browser origin validation for WebSocket clients by introducing a new
shouldCheckBrowserOrigingate that enforces origin checks for any client that either sends anOriginheader OR declares a browser client mode (ui/webchat). The implementation correctly separates the decision logic (when to check) from the validation logic (what to check), making the security boundary more explicit and testable.Key security improvements:
mode: uiormode: webchat)Originheader, regardless of declared modePlatform security hardening:
openclaw/identityfrom cloud backup and device transfer to prevent identity material leakageshouldForceTLS→shouldRequireTLSand addsresolveManualUseTLSwrapper for clearer TLS enforcement logicgetGatewaySocketUrlSecurityErrorhelperThe changes align well with the codebase's existing security patterns and maintain backward compatibility for legitimate use cases.
Confidence Score: 4/5
WEBCHATmode inshouldCheckBrowserOrigin, which is a minor issue since the e2e tests cover Control UI (which usesWEBCHATmode) extensively. The security logic is sound and follows the repository's established patterns.Last reviewed commit: 3577aef