fix(browser): harden browser control override loading by eleqtrizit · Pull Request #62663 · openclaw/openclaw

eleqtrizit · 2026-04-07T18:19:05Z

Summary

Hardens browser control override loading so untrusted workspace .env files cannot inject browser override module settings
Keeps the extension oxlint lanes deterministic on clean checkouts when the Plugin SDK declaration artifacts have not been generated yet

Changes

Blocked OPENCLAW_BROWSER_CONTROL_MODULE and OPENCLAW_SKIP_BROWSER_CONTROL_SERVER from workspace .env loading
Added optional override-specifier validation to startLazyPluginServiceModule() and used it for the browser plugin service to reject unsafe URL-style specifiers
Added regression tests for workspace .env blocking, lazy override validation, and the browser plugin service validator
Regenerated the Plugin SDK API baseline hash for the added optional loader parameter
Updated the extension oxlint wrapper to prepare Plugin SDK boundary artifacts before linting extension trees on a clean checkout

Validation

Ran corepack pnpm test src/infra/dotenv.test.ts src/plugins/lazy-service-module.test.ts extensions/browser/src/plugin-service.test.ts
Ran corepack pnpm format
Ran corepack pnpm build
Ran corepack pnpm plugin-sdk:api:gen
Ran corepack pnpm tsgo
Ran rm -rf dist/plugin-sdk packages/plugin-sdk/dist && corepack pnpm lint:extensions:channels
Ran corepack pnpm lint:extensions:bundled
Attempted local Claude review before PR creation; the /review flow requested an existing PR selection instead of reviewing the local diff

Notes

This keeps trusted explicit overrides working for supported local module specifiers while rejecting the unsafe URL-style override forms used by the repro path
Earlier closed work on this topic was reviewed for approach, but this PR uses the current loader structure and test layout on main

greptile-apps · 2026-04-07T18:22:27Z

Greptile Summary

This PR hardens browser control override loading through two complementary layers: blocking OPENCLAW_BROWSER_CONTROL_MODULE and OPENCLAW_SKIP_BROWSER_CONTROL_SERVER from untrusted workspace .env files, and adding optional specifier validation to startLazyPluginServiceModule() with a regex-based validator in the browser plugin service that rejects URL-style override specifiers. A third change ensures Plugin SDK boundary artifacts are prepared before extension oxlint runs on clean checkouts. Test coverage is thorough across all three surfaces.

Confidence Score: 5/5

Safe to merge; the dotenv-level block is the primary defense and is correctly implemented.

All remaining findings are P2. The only gap is the missing file: scheme in the validator regex, which is a defense-in-depth completeness issue rather than an exploitable weakness given the dotenv-level guard already in place. The core logic, test coverage, and script changes are correct.

extensions/browser/src/plugin-service.ts — consider adding file: to the UNSAFE_BROWSER_CONTROL_OVERRIDE_SPECIFIER regex for completeness.

Vulnerabilities

The two-layer defense (dotenv blocklist + specifier validator) correctly addresses the workspace .env injection threat for OPENCLAW_BROWSER_CONTROL_MODULE.
The validator regex omits the file: URL scheme, which is a valid Node.js ESM import form. Since the dotenv block is the primary guard and file: requires write access to the local filesystem plus the ability to set a trusted env var, this is low-risk in practice but worth noting for completeness.
No credential exposure, secrets leakage, or injection vulnerabilities introduced.

Prompt To Fix All With AI

This is a comment left during a code review.
Path: extensions/browser/src/plugin-service.ts
Line: 8

Comment:
**`file:` URL not blocked by override validator**

The regex blocks `data:`, `http:`, `https:`, and `node:` schemes but omits `file:`. A `file:///attacker/module.js` specifier passes the validator and is a valid ESM import in Node.js. The dotenv-level block is the primary guard (already in place), so this is defense-in-depth only — but since the intent is to reject "URL-style specifiers", `file:` fits the same threat model as the others.

```suggestion
const UNSAFE_BROWSER_CONTROL_OVERRIDE_SPECIFIER = /^(?:data|file|http|https|node):/i;
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (2): Last reviewed commit: "fix(lint): prepare boundary artifacts fo..." | Re-trigger Greptile}

eleqtrizit · 2026-04-08T02:00:25Z

@greptile review

eleqtrizit · 2026-04-08T02:00:25Z

@codex review

chatgpt-codex-connector · 2026-04-08T02:04:20Z

Codex Review: Didn't find any major issues. Another round soon, please!

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3cb88918e6

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

* main: (522 commits) fix(browser): re-check interaction-driven navigations (openclaw#63226) test: reuse verbose directive reply imports test: reuse exec directive reply imports fix(browser): harden browser control override loading (openclaw#62663) Matrix: report startup failures as errors auth: persist explicit profile upserts directly test(doctor): mock memory-core runtime seam auth: avoid external cli sync on profile upsert feat: parallelize character eval runs fix: load QA live provider overrides build: stage nostr runtime dependencies fix(dotenv): block workspace runtime env vars (openclaw#62660) build: narrow plugin SDK declaration build test: harden Parallels macOS smoke fallback fix(memory): accept embedded dreaming heartbeat tokens test: harden provider mock isolation docs(config): tighten wording in reference test: reuse followup runner imports test: reuse image generate tool imports Align remote node exec event system messages with untrusted handling (openclaw#62659) ...

* fix(browser): harden browser control overrides * fix(lint): prepare boundary artifacts for extension oxlint * docs(changelog): add browser override hardening entry * fix(lint): avoid duplicate boundary prep --------- Co-authored-by: Devin Robison <[email protected]> Co-authored-by: Devin Robison <[email protected]>

openclaw-barnacle Bot added docs Improvements or additions to documentation size: S maintainer Maintainer-authored PR labels Apr 7, 2026

openclaw-barnacle Bot added the scripts Repository scripts label Apr 7, 2026

drobison00 force-pushed the 355 branch from 1d91308 to 21a83ca Compare April 8, 2026 18:58

eleqtrizit and others added 3 commits April 8, 2026 13:07

fix(browser): harden browser control overrides

a92b68c

fix(lint): prepare boundary artifacts for extension oxlint

49db143

docs(changelog): add browser override hardening entry

3cb8891

drobison00 force-pushed the 355 branch from 21a83ca to 3cb8891 Compare April 8, 2026 19:07

chatgpt-codex-connector Bot reviewed Apr 8, 2026

View reviewed changes

Comment thread scripts/lib/run-extension-oxlint.mjs Outdated

fix(lint): avoid duplicate boundary prep

df58ad7

openclaw-barnacle Bot removed the scripts Repository scripts label Apr 8, 2026

Merge branch 'main' into 355

3288fc3

drobison00 merged commit dafcaf9 into openclaw:main Apr 8, 2026
8 checks passed

github-actions Bot mentioned this pull request Apr 8, 2026

📡 Upstream Digest — 2026-04-08 20:35 UTC curtismercier/openclaw-mods#513

Open

github-actions Bot mentioned this pull request Apr 13, 2026

Update ghcr.io/openclaw/openclaw Docker tag to v2026.5.7 - autoclosed claytono/infra#1977

Closed

1 task

clawsweeper Bot mentioned this pull request May 15, 2026

dotenv loader does not expand env references in .env files #38259

Open

eleqtrizit deleted the 355 branch June 30, 2026 19:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(browser): harden browser control override loading#62663

fix(browser): harden browser control override loading#62663
drobison00 merged 5 commits into
openclaw:mainfrom
eleqtrizit:355

eleqtrizit commented Apr 7, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Apr 7, 2026 •

edited

Loading

Vulnerabilities

Uh oh!

eleqtrizit commented Apr 8, 2026

Uh oh!

eleqtrizit commented Apr 8, 2026

Uh oh!

chatgpt-codex-connector Bot commented Apr 8, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

eleqtrizit commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Validation

Notes

Uh oh!

greptile-apps Bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Vulnerabilities

Uh oh!

eleqtrizit commented Apr 8, 2026

Uh oh!

eleqtrizit commented Apr 8, 2026

Uh oh!

chatgpt-codex-connector Bot commented Apr 8, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

eleqtrizit commented Apr 7, 2026 •

edited

Loading

greptile-apps Bot commented Apr 7, 2026 •

edited

Loading