security(message-tool): validate filePath/path against sandbox root by leszekszpunar · Pull Request #6398 · openclaw/openclaw

leszekszpunar · 2026-02-01T16:35:40Z

Summary

Fixes #3805 (CRITICAL sandbox escape via message tool filePath/path params).

Note: Previous PR #6181 was auto-closed by CLAWDINATOR triage bot. This is a critical security fix for an existing open issue, not a feature or improvement. Issue #3805 documents a confirmed sandbox escape with PoC.

The message tool accepted arbitrary file paths (filePath, path) without validating them against the sandbox root directory. A sandboxed agent could read or exfiltrate host files (e.g. /etc/passwd, ~/.ssh/id_rsa) by passing absolute or traversal paths through the message tool's send action.

Changes

src/agents/tools/message-tool.ts: Added sandboxRoot option to MessageToolOptions. When set, both filePath and path params are validated via assertSandboxPath() before runMessageAction() is called. This mirrors the pattern already used in image-tool.ts and read/write/edit tools.
src/agents/openclaw-tools.ts: Pass sandboxRoot from tool creation options to createMessageTool().
src/agents/tools/message-tool.test.ts: Added 4 tests covering sandbox path validation (reject absolute escape, reject traversal, allow valid relative path, skip validation when no sandbox).

Security Impact

Without this fix, any sandboxed agent session could bypass the sandbox boundary via the message tool to access arbitrary host filesystem paths. This is a critical privilege escalation vector.

AI Disclosure

This PR was developed with AI assistance (Claude Code). The code was reviewed, tested, and verified by the author. All tests pass, linting is clean, and the fix follows existing patterns in the codebase (image-tool.ts, read/write tools).

Test Plan

pnpm vitest run src/agents/tools/message-tool.test.ts (8/8 pass)
npx oxlint --type-aware --tsconfig tsconfig.oxlint.json (0 errors)
npx oxfmt --check (all files formatted)
Build errors are pre-existing on main (unrelated pi-coding-agent type issues)

Greptile Overview

Greptile Summary

This PR threads a sandboxRoot option into the message agent tool and uses the existing assertSandboxPath() helper to validate filePath/path parameters before dispatching to runMessageAction(), closing a sandbox escape vector where a sandboxed agent could reference arbitrary host paths. createOpenClawTools() now forwards sandboxRoot into createMessageTool(), and new Vitest cases exercise absolute-path and traversal rejection, as well as the “no sandboxRoot” passthrough.

The approach aligns with other sandbox-aware tools (e.g. image-tool.ts and the read/write/edit tools) by enforcing a single sandbox boundary at the tool surface before any plugin/channel code sees the path.

Confidence Score: 4/5

This PR is likely safe to merge and meaningfully improves sandbox safety, with a couple of edge cases to confirm.
The change is localized and reuses the existing assertSandboxPath() sandbox boundary check, and tests cover key escape inputs. Remaining uncertainty is around how path is interpreted across different message actions/channels and whether an untrimmed sandboxRoot could lead to unexpected behavior in misconfigured callers.
src/agents/tools/message-tool.ts

greptile-apps

_{2 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-01T16:37:19Z

src/agents/tools/message-tool.ts

+      // Validate file paths against sandbox root to prevent host file access.
+      const sandboxRoot = options?.sandboxRoot;
+      if (sandboxRoot) {
+        for (const key of ["filePath", "path"] as const) {
+          const raw = readStringParam(params, key, { trim: false });
+          if (raw) {
+            await assertSandboxPath({ filePath: raw, cwd: sandboxRoot, root: sandboxRoot });
+          }


[P0] sandboxRoot is used without trimming/normalizing, unlike image-tool.ts, so a value like ' ' will enable the sandbox branch but effectively set cwd/root to a non-sandbox path (e.g. current working directory), which can cause false rejections or unintended behavior depending on how assertSandboxPath resolves. Consider const sandboxRoot = options?.sandboxRoot?.trim(); and only validating when it's non-empty.

Prompt To Fix With AI

This is a comment left during a code review. Path: src/agents/tools/message-tool.ts Line: 367:374 Comment: [P0] `sandboxRoot` is used without trimming/normalizing, unlike `image-tool.ts`, so a value like `' '` will enable the sandbox branch but effectively set `cwd/root` to a non-sandbox path (e.g. current working directory), which can cause false rejections or unintended behavior depending on how `assertSandboxPath` resolves. Consider `const sandboxRoot = options?.sandboxRoot?.trim();` and only validating when it's non-empty. How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-02-01T16:37:20Z

src/agents/tools/message-tool.ts

+      // Validate file paths against sandbox root to prevent host file access.
+      const sandboxRoot = options?.sandboxRoot;
+      if (sandboxRoot) {
+        for (const key of ["filePath", "path"] as const) {
+          const raw = readStringParam(params, key, { trim: false });
+          if (raw) {
+            await assertSandboxPath({ filePath: raw, cwd: sandboxRoot, root: sandboxRoot });
+          }
+        }


[P1] Validating both filePath and path unconditionally for all actions may break non-file uses of path (e.g. channels/actions that interpret path as something other than a local filesystem path). If path is only meant for attachments on send, it’s safer to scope this validation to action === "send" (and/or only when media/attachments are being used).

Prompt To Fix With AI

This is a comment left during a code review. Path: src/agents/tools/message-tool.ts Line: 367:375 Comment: [P1] Validating both `filePath` and `path` unconditionally for all actions may break non-file uses of `path` (e.g. channels/actions that interpret `path` as something other than a local filesystem path). If `path` is only meant for attachments on `send`, it’s safer to scope this validation to `action === "send"` (and/or only when `media`/attachments are being used). How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-02-01T16:37:21Z

src/agents/tools/message-tool.test.ts

+  it("allows filePath inside sandbox root", async () => {
+    mocks.runMessageAction.mockClear();
+    mocks.runMessageAction.mockResolvedValue({
+      kind: "send",
+      action: "send",
+      channel: "telegram",
+      to: "telegram:123",
+      handledBy: "plugin",
+      payload: {},
+      dryRun: true,
+    } satisfies MessageActionRunResult);
+
+    const sandboxDir = await fs.mkdtemp(path.join(os.tmpdir(), "msg-sandbox-"));
+    try {
+      const tool = createMessageTool({
+        config: {} as never,
+        sandboxRoot: sandboxDir,
+      });
+
+      await tool.execute("1", {
+        action: "send",
+        target: "telegram:123",
+        filePath: "./data/file.txt",
+        message: "",
+      });
+
+      expect(mocks.runMessageAction).toHaveBeenCalledTimes(1);


[P2] allows filePath inside sandbox root only asserts that runMessageAction was called, but doesn’t verify the validated path behavior. This can pass even if the validation is accidentally skipped. Consider asserting the call still receives the original relative filePath and (optionally) that an escaping filePath rejects in the same test suite.

_{Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!}

Prompt To Fix With AI

This is a comment left during a code review. Path: src/agents/tools/message-tool.test.ts Line: 211:237 Comment: [P2] `allows filePath inside sandbox root` only asserts that `runMessageAction` was called, but doesn’t verify the validated path behavior. This can pass even if the validation is accidentally skipped. Consider asserting the call still receives the original relative `filePath` and (optionally) that an escaping `filePath` rejects in the same test suite. <sub>Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!</sub> How can I resolve this? If you propose a fix, please make it concise.

steipete · 2026-02-01T22:20:09Z

Landed via temp rebase onto main (squash merge).

Gate: pnpm lint (fails: no-redundant-type-constituents in extensions/*), pnpm build (fails: DefaultResourceLoader type errors), pnpm test (fails: DefaultResourceLoader is not a constructor in pi-embedded-runner tests)
Land commit: ${land_sha}
Merge commit: ${merge_sha}

Thanks @leszekszpunar!

…penclaw#6398) * security(message-tool): validate filePath/path against sandbox root * style: translate Polish comments to English for consistency

…penclaw#6398) * security(message-tool): validate filePath/path against sandbox root * style: translate Polish comments to English for consistency (cherry picked from commit 9b6fffd) # Conflicts: # src/agents/tools/message-tool.ts

…penclaw#6398) * security(message-tool): validate filePath/path against sandbox root * style: translate Polish comments to English for consistency

…kszpunar

…kszpunar)

leszekszpunar added 2 commits February 1, 2026 12:00

security(message-tool): validate filePath/path against sandbox root

624f57d

style: translate Polish comments to English for consistency

84a9eed

openclaw-barnacle bot added the agents Agent runtime and tooling label Feb 1, 2026

greptile-apps bot reviewed Feb 1, 2026

View reviewed changes

steipete self-assigned this Feb 1, 2026

steipete added a commit that referenced this pull request Feb 1, 2026

fix: harden message-tool sandbox paths (#6398) (thanks @leszekszpunar)

0dbe018

steipete merged commit 9b6fffd into openclaw:main Feb 1, 2026
39 of 48 checks passed

github-actions bot mentioned this pull request Feb 8, 2026

cherry-pick: upstream deps/security commits (2026-02-08) hughdidit/DAISy-Agency#107

Closed

6 tasks

github-actions bot mentioned this pull request Feb 8, 2026

cherry-pick: upstream deps/security commits (2026-02-08-2013) hughdidit/DAISy-Agency#115

Open

6 tasks

This was referenced Feb 14, 2026

[Bug]: Local media path is not under an allowed directory #15541

Closed

[Bug]: Sandbox tool permissions do not check bound folders #16379

Open

Limitless2023 mentioned this pull request Feb 14, 2026

fix: allow Docker bind mount paths in sandbox tools #16389

Open

jamie-dit pushed a commit to jamie-dit/zulip-claw that referenced this pull request Feb 20, 2026

fix: harden message-tool sandbox paths (openclaw#6398) (thanks @lesze…

5b3ac88

…kszpunar)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Comments

security(message-tool): validate filePath/path against sandbox root#6398

security(message-tool): validate filePath/path against sandbox root#6398
steipete merged 2 commits intoopenclaw:mainfrom
leszekszpunar:fix/3805-message-tool-sandbox-bypass

leszekszpunar commented Feb 1, 2026 •

edited by greptile-apps bot

Loading

Uh oh!

greptile-apps bot left a comment

Uh oh!

greptile-apps bot Feb 1, 2026

Uh oh!

greptile-apps bot Feb 1, 2026

Uh oh!

greptile-apps bot Feb 1, 2026

Uh oh!

Uh oh!

steipete commented Feb 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Comments

Conversation

leszekszpunar commented Feb 1, 2026 • edited by greptile-apps bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Security Impact

AI Disclosure

Test Plan

Greptile Overview

Greptile Summary

Confidence Score: 4/5

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 1, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 1, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 1, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

steipete commented Feb 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

leszekszpunar commented Feb 1, 2026 •

edited by greptile-apps bot

Loading