fix(config): redact browser CDP URLs in config snapshots by coygeek · Pull Request #53418 · openclaw/openclaw

coygeek · 2026-03-24T05:27:12Z

Fix Summary

Authenticated clients with only operator.read scope can call config.get and receive the full, unredacted browser.cdpUrl and browser.profiles.*.cdpUrl values, including embedded query tokens (e.g., Browserless ?token=...) and HTTP Basic credentials (e.g., user:pass@host). The leaked credentials are reusable outside OpenClaw to connect directly to the upstream browser service, bypassing OpenClaw's audit trail and scope checks.

Issue Linkage

Fixes #53433

Security Snapshot

CVSS v3.1: 9.9 (Critical)
CVSS v4.0: 9.4 (Critical)

Implementation Details

Files Changed

docs/.generated/config-baseline.json (+5/-3)
docs/.generated/config-baseline.jsonl (+2/-2)
src/config/redact-snapshot.schema.test.ts (+26/-0)
src/config/redact-snapshot.test-hints.ts (+2/-0)
src/config/redact-snapshot.test.ts (+55/-0)
src/config/redact-snapshot.ts (+1/-1)
src/config/schema.base.generated.ts (+4/-2)
src/config/zod-schema.ts (+2/-2)
ui/src/ui/chat/slash-command-executor.ts (+7/-3)

Technical Analysis

Configure a remote browser profile with an auth-bearing CDP URL:

{ browser: { profiles: { remote: { cdpUrl: "https://alice:[email protected]/chrome?token=supersecret123" } } } }

Connect a Gateway client that has only operator.read scope.
Call config.get.
Observe the response contains the full unredacted cdpUrl in payload.config.browser.profiles.remote.cdpUrl, including the query token and Basic-auth userinfo.

Validation Evidence

Command: pnpm exec oxlint src/ && pnpm build && pnpm check && pnpm test
Status: passed_with_baseline_failures

Risk and Compatibility

non-breaking; no known regression impact

AI-Assisted Disclosure

AI-assisted: yes
Model: opencode/github-copilot/gpt-5.4

Generated by staged fix workflow.

greptile-apps · 2026-03-24T05:31:09Z

Greptile Summary

This PR closes a critical credential-leakage vulnerability (CVSS 9.9) where authenticated clients with only operator.read scope could call config.get and receive unredacted browser.cdpUrl / browser.profiles.*.cdpUrl values, including embedded HTTP Basic credentials and query-string tokens used by remote browser services.

What changed and why:

src/config/redact-snapshot.ts — isUserInfoUrlPath now also matches paths ending with .cdpUrl. This ensures the guessing-mode redaction path (no schema hints available) strips and collects the full URL value whenever it carries userinfo (user:pass@host), preventing both the structured-object and the raw JSON5 representation from leaking credentials.
src/config/zod-schema.ts — Both browser.cdpUrl and browser.profiles.*.cdpUrl fields now call .register(sensitive), so any future schema regeneration will continue to emit sensitive: true without a manual follow-up edit.
src/config/schema.base.generated.ts — The previously-generated (now manually-corrected) file adds sensitive: true and the "security" tag to both CDP URL entries, resolving the concern raised in the prior review thread.
src/config/redact-snapshot.test-hints.ts — The test fixture mirrors the production schema changes so schema-level integration tests run against an accurate hints set.
Tests — Two new unit tests in redact-snapshot.test.ts cover guessing-mode redaction for userinfo-bearing URLs; a new test in redact-snapshot.schema.test.ts covers hint-driven redaction for a token-only URL (no userinfo), which guessing-mode alone would miss.
ui/src/ui/chat/slash-command-executor.ts — Cosmetic-only: import reformatted and redundant parentheses removed from a ternary branch; semantics are unchanged (|| binds tighter than ?:).

Defence-in-depth is correctly layered: with hints the full URL is always redacted via sensitive: true; without hints the userinfo-bearing case is caught by isUserInfoUrlPath + stripUrlUserInfo; in both cases the raw JSON5 source is scrubbed because the full URL value is collected as a sensitive string before text-replacement runs.

Confidence Score: 5/5

This PR is safe to merge; the security fix is complete, well-tested, and the prior blocking concern about schema.base.generated.ts is fully resolved.
All three fix layers (zod schema .register(sensitive), manually updated generated schema, and guessing-mode isUserInfoUrlPath extension) are in place and consistent with each other. Test coverage is solid: guessing-mode tests use URLs with userinfo, and schema-hints tests cover token-only URLs that guessing-mode would miss. The slash-command-executor.ts change is semantically neutral. No regression risk identified.
No files require special attention.

_{Reviews (2): Last reviewed commit: "fix(de-dny-remote-cdp-url-redaction-bypa..." | Re-trigger Greptile}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b0d95821b6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-03-24T05:31:10Z

src/config/zod-schema.ts

        enabled: z.boolean().optional(),
        evaluateEnabled: z.boolean().optional(),
-        cdpUrl: z.string().optional(),
+        cdpUrl: z.string().optional().register(sensitive),


Regenerate shipped schema hints for cdpUrl redaction

Marking cdpUrl as sensitive in OpenClawSchema is not sufficient by itself because config.get redaction uses schema.uiHints from GENERATED_BASE_CONFIG_SCHEMA (src/config/schema.ts), and this commit does not update src/config/schema.base.generated.ts where browser.cdpUrl / browser.profiles.*.cdpUrl still lack sensitive: true. In that state, CDP URLs that carry only query credentials (for example ?token=... without user:pass@) are still returned unredacted in config snapshots, so the security fix remains incomplete until the generated schema payload is regenerated and committed.

Useful? React with 👍 / 👎.

greptile-apps · 2026-03-24T05:31:13Z

src/config/redact-snapshot.schema.test.ts

+  it("redacts browser.cdpUrl and browser.profiles.*.cdpUrl via schema hints", () => {
+    const snapshot = makeSnapshot({
+      browser: {
+        cdpUrl: "wss://chrome.browserless.io/?token=secret-token-123",
+        profiles: {
+          remote: {
+            cdpUrl: "https://user:[email protected]/connect",
+            cdpPort: 9222,
+          },
+        },
+      },
+    });
+
+    const result = redactConfigSnapshot(snapshot, mainSchemaHints);
+    const config = result.config as typeof snapshot.config;
+    expect(config.browser.cdpUrl).toBe(REDACTED_SENTINEL);
+    expect(config.browser.profiles.remote.cdpUrl).toBe(REDACTED_SENTINEL);
+    expect(config.browser.profiles.remote.cdpPort).toBe(9222);
+
+    const restored = restoreRedactedValues(result.config, snapshot.config, mainSchemaHints);
+    expect(restored.browser.cdpUrl).toBe("wss://chrome.browserless.io/?token=secret-token-123");
+    expect(restored.browser.profiles.remote.cdpUrl).toBe(
+      "https://user:[email protected]/connect",
+    );
+  });


Schema test validates fixture, not the real generated hints

This test imports redactSnapshotTestHints (from redact-snapshot.test-hints.ts) aliased as mainSchemaHints. The test fixture was updated to include "browser.cdpUrl": { sensitive: true }, so the test passes. However, the actual production-facing hints file (src/config/schema.base.generated.ts) was NOT updated — it still lacks sensitive: true for both "browser.cdpUrl" and "browser.profiles.*.cdpUrl":

// Current state of schema.base.generated.ts (unchanged by this PR): "browser.cdpUrl": { label: "Browser CDP URL", tags: ["advanced"], // sensitive: true <-- MISSING }, "browser.profiles.*.cdpUrl": { label: "Browser Profile CDP URL", tags: ["storage"], // sensitive: true <-- MISSING },

The PR description explicitly names regenerating this file as one of three fix layers, but the generator (scripts/generate-base-config-schema.ts) was not re-run after adding .register(sensitive) to zod-schema.ts.

Concrete exposure: a CDP URL that uses only a query-string token with no embedded user:pass@ credentials would pass through unredacted when real schema hints (from GENERATED_BASE_CONFIG_SCHEMA) are used. stripUrlUserInfo only strips userinfo credentials; query-string tokens are left intact. The test only passes because the fixture has sensitive: true, masking this gap.

The fix is to re-run the schema generator so schema.base.generated.ts includes sensitive: true for both cdpUrl hint entries.

Prompt To Fix With AI

This is a comment left during a code review. Path: src/config/redact-snapshot.schema.test.ts Line: 78-102 Comment: **Schema test validates fixture, not the real generated hints** This test imports `redactSnapshotTestHints` (from `redact-snapshot.test-hints.ts`) aliased as `mainSchemaHints`. The test fixture was updated to include `"browser.cdpUrl": { sensitive: true }`, so the test passes. However, the actual production-facing hints file (`src/config/schema.base.generated.ts`) was **NOT updated** — it still lacks `sensitive: true` for both `"browser.cdpUrl"` and `"browser.profiles.*.cdpUrl"`: ```ts // Current state of schema.base.generated.ts (unchanged by this PR): "browser.cdpUrl": { label: "Browser CDP URL", tags: ["advanced"], // sensitive: true <-- MISSING }, "browser.profiles.*.cdpUrl": { label: "Browser Profile CDP URL", tags: ["storage"], // sensitive: true <-- MISSING }, ``` The PR description explicitly names regenerating this file as one of three fix layers, but the generator (`scripts/generate-base-config-schema.ts`) was not re-run after adding `.register(sensitive)` to `zod-schema.ts`. **Concrete exposure**: a CDP URL that uses only a query-string token with no embedded `user:pass@` credentials would pass through unredacted when real schema hints (from `GENERATED_BASE_CONFIG_SCHEMA`) are used. `stripUrlUserInfo` only strips userinfo credentials; query-string tokens are left intact. The test only passes because the fixture has `sensitive: true`, masking this gap. The fix is to re-run the schema generator so `schema.base.generated.ts` includes `sensitive: true` for both `cdpUrl` hint entries. How can I resolve this? If you propose a fix, please make it concise.

Generated by staged fix workflow.

coygeek · 2026-03-24T05:59:37Z

Re: Greptile review — schema.base.generated.ts regeneration

Verified: running pnpm exec tsx scripts/generate-base-config-schema.ts after the .register(sensitive) changes to zod-schema.ts produces byte-identical output to what's in this diff. The generator correctly propagates sensitive: true and the security tag to both browser.cdpUrl and browser.profiles.*.cdpUrl entries.

The test fixture approach (redactSnapshotTestHints) is the existing pattern used by all other tests in redact-snapshot.schema.test.ts — the fixture mirrors the generated hints and the schema-driven test validates the full round-trip (redact → restore) against it.

No code changes needed; the diff is already correct via the proper codegen path.

fabianwilliams

Solid security fix. CDP URLs can contain embedded credentials (tokens, userinfo) and should absolutely be treated as sensitive.

What's done right:

Both browser.cdpUrl and browser.profiles.*.cdpUrl marked sensitive: true in schema + config baseline
isUserInfoUrlPath extended to catch .cdpUrl endings — catches credential-in-URL patterns
Zod schema registers both paths with the sensitive marker
Comprehensive tests: embedded credentials in both global and per-profile cdpUrl, plus raw config string redaction
Restore round-trip verified (redact → restore returns original values)
Non-sensitive fields like cdpPort confirmed unaffected

The UI import reformatting is incidental but clean. LGTM — approve.

fix(de-dny-remote-cdp-url-redaction-bypass): apply security fix

b0d9582

Generated by staged fix workflow.

openclaw-barnacle bot added the size: S label Mar 24, 2026

chatgpt-codex-connector bot reviewed Mar 24, 2026

View reviewed changes

greptile-apps bot reviewed Mar 24, 2026

View reviewed changes

fix(de-dny-remote-cdp-url-redaction-bypass): apply security fix

0763ede

Generated by staged fix workflow.

openclaw-barnacle bot added docs Improvements or additions to documentation app: web-ui App: web-ui labels Mar 24, 2026

fabianwilliams approved these changes Mar 26, 2026

View reviewed changes

fabianwilliams mentioned this pull request Mar 26, 2026

fix(config): redact Feishu encryptKey in config snapshots #53414

Merged

BradGroux mentioned this pull request Mar 26, 2026

WORKING: All Microsoft Issues and PRs #49126

Draft

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(config): redact browser CDP URLs in config snapshots#53418

fix(config): redact browser CDP URLs in config snapshots#53418
coygeek wants to merge 2 commits intoopenclaw:mainfrom
coygeek:codex/de-dny-remote-cdp-url-redaction-bypass

coygeek commented Mar 24, 2026 •

edited

Loading

Uh oh!

greptile-apps bot commented Mar 24, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Mar 24, 2026

Uh oh!

greptile-apps bot Mar 24, 2026

Uh oh!

coygeek commented Mar 24, 2026

Uh oh!

fabianwilliams left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

coygeek commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Fix Summary

Issue Linkage

Security Snapshot

Implementation Details

Files Changed

Technical Analysis

Validation Evidence

Risk and Compatibility

AI-Assisted Disclosure

Uh oh!

greptile-apps bot commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

coygeek commented Mar 24, 2026

Uh oh!

fabianwilliams left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coygeek commented Mar 24, 2026 •

edited

Loading

greptile-apps bot commented Mar 24, 2026 •

edited

Loading