fix(browser): tighten strict browser hostname navigation by eleqtrizit · Pull Request #64367 · openclaw/openclaw

eleqtrizit · 2026-04-10T15:10:24Z

Summary

tighten strict browser navigation so hostname-based URLs do not proceed when Chromium would re-resolve DNS outside the Node-side SSRF checks
route strict CDP HTTP discovery through the pinned SSRF fetch path

Changes

reject strict-policy hostname navigation unless the hostname is an explicit operator allowlist exception or an IP literal
pass browser CDP /json/version requests through fetchWithSsrFGuard when an SSRF policy is active
add regression coverage for strict hostname navigation denial in the browser navigation, CDP, and Playwright navigation tests

Validation

Ran corepack pnpm test extensions/browser/src/browser/navigation-guard.test.ts extensions/browser/src/browser/cdp.test.ts extensions/browser/src/browser/pw-session.create-page.navigation-guard.test.ts
Ran corepack pnpm check
Attempted local agentic review with claude -p "/review", but the command timed out without output

Notes

This is a holding fix: strict hostname-based browser navigation now fails closed unless the hostname is explicitly allowlisted
CDP WebSocket attachment remains operator-configured surface area; the patch hardens the HTTP discovery path without changing remote browser attachment contracts

greptile-apps · 2026-04-10T15:15:59Z

Greptile Summary

This PR tightens browser SSRF protections in two ways: (1) hostname-based URLs are blocked in strict mode unless the hostname is an IP literal or explicitly operator-allowlisted (because Chromium's network stack re-resolves DNS independently from Node's SSRF checks), and (2) CDP HTTP discovery requests (/json/version, /json/list, etc.) are now routed through fetchWithSsrFGuard when an SSRF policy is active. The release-ordering bug flagged in the previous round is resolved — release() is now called after the response body is fully consumed, verified by the new cdp.helpers.test.ts fixture.

Confidence Score: 5/5

Safe to merge — no P0/P1 issues found; previous release-ordering bug is resolved and the strict hostname gate is well-tested.

All remaining findings are P2 (minor inline normalization vs shared helper). The two previously flagged blocking issues (release() ordering and the agent work-log file) are both resolved in this revision. Comprehensive regression tests cover the new strict-mode paths.

No files require special attention.

_{Reviews (2): Last reviewed commit: "fix(browser): address review follow-ups" | Re-trigger Greptile}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: abbad83bc8

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

eleqtrizit · 2026-04-10T15:34:31Z

@codex review

eleqtrizit · 2026-04-10T15:34:33Z

@greptile review

chatgpt-codex-connector · 2026-04-10T15:41:40Z

Codex Review: Didn't find any major issues. Delightful!

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

The PR's SelectionDeps uses getSsrFPolicy instead of the full state object; the state property was leftover from an earlier iteration.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7e78000ad1

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-04-10T19:24:12Z

-          cdpUrl: profile.cdpUrl,
-          ssrfPolicy: state().resolved.ssrfPolicy,
-        });
+        const pages = await listPagesViaPlaywright({ cdpUrl: profile.cdpUrl });


Propagate SSRF policy to Playwright listTabs calls

This call now invokes listPagesViaPlaywright without ssrfPolicy, and the pre-check assertCdpEndpointAllowed was also removed in this function. In strict mode, that means connectBrowser receives undefined policy and skips endpoint SSRF validation on cache miss, so a blocked cdpUrl can still be connected and cached before any guard runs. This is a security regression for remote profiles that use persistent Playwright tab listing.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-04-10T19:24:12Z

        await focusPageByTargetIdViaPlaywright({
          cdpUrl: profile.cdpUrl,
          targetId: resolvedTargetId,
-          ssrfPolicy: state().resolved.ssrfPolicy,
        });


Propagate SSRF policy to Playwright focus/close calls

The Playwright focus/close path now omits ssrfPolicy when calling focusPageByTargetIdViaPlaywright (and similarly closePageByTargetIdViaPlaywright below), while endpoint pre-checks were removed from this file. Because Playwright session attachment enforces endpoint SSRF policy only when connectBrowser is called with a policy on cache miss, these operations can bypass strict cdpUrl blocking for remote profiles.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-04-10T19:24:12Z

+  await resolvePinnedHostnameWithPolicy(parsed.hostname, {
+    policy: ssrfPolicy,
+  });


Rewrap endpoint SSRF failures as endpoint-scoped errors

Removing the SsrFBlockedError -> BrowserCdpEndpointBlockedError conversion here changes error classification for blocked CDP endpoints. toBrowserErrorResponse still treats raw SsrFBlockedError as a navigation-target failure, so strict-policy endpoint denials are now reported as navigation blocks instead of endpoint configuration blocks, which breaks the existing endpoint-vs-navigation error contract.

Useful? React with 👍 / 👎.

) * fix(browser): tighten strict browser hostname navigation * fix(browser): address review follow-ups * chore(changelog): add strict browser hostname navigation entry * fix(browser): remove stale state prop from SelectionDeps call site The PR's SelectionDeps uses getSsrFPolicy instead of the full state object; the state property was leftover from an earlier iteration. --------- Co-authored-by: Devin Robison <[email protected]>

openclaw-barnacle Bot added size: S maintainer Maintainer-authored PR labels Apr 10, 2026

greptile-apps Bot reviewed Apr 10, 2026

View reviewed changes

Comment thread extensions/browser/src/browser/cdp.helpers.ts Outdated

Comment thread USER.md Outdated

Comment thread extensions/browser/src/browser/navigation-guard.ts

chatgpt-codex-connector Bot reviewed Apr 10, 2026

View reviewed changes

Comment thread extensions/browser/src/browser/navigation-guard.ts Outdated

openclaw-barnacle Bot added size: M and removed size: S labels Apr 10, 2026

eleqtrizit and others added 3 commits April 10, 2026 13:12

fix(browser): tighten strict browser hostname navigation

cd9e1e6

fix(browser): address review follow-ups

9eecc5b

chore(changelog): add strict browser hostname navigation entry

bbe43b5

drobison00 force-pushed the browser-ssrf-guard branch from 7bf8540 to bbe43b5 Compare April 10, 2026 19:13

fix(browser): remove stale state prop from SelectionDeps call site

7e78000

The PR's SelectionDeps uses getSsrFPolicy instead of the full state object; the state property was leftover from an earlier iteration.

drobison00 merged commit 121c452 into openclaw:main Apr 10, 2026
8 checks passed

chatgpt-codex-connector Bot reviewed Apr 10, 2026

View reviewed changes

This was referenced Apr 10, 2026

📡 Upstream Digest — 2026-04-10 20:27 UTC curtismercier/openclaw-mods#531

Open

Update ghcr.io/openclaw/openclaw Docker tag to v2026.5.7 - autoclosed claytono/infra#1977

Closed

This was referenced May 24, 2026

[Feature]: Built-in headless browser for reliable web access without external dependencies #53763

Open

Browser tool should reject or redact URLs with embedded credentials instead of passing them through #55365

Closed

clawsweeper Bot mentioned this pull request Jul 8, 2026

fix(browser): handle Chrome launch stderr pipe errors #101933

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(browser): tighten strict browser hostname navigation#64367

fix(browser): tighten strict browser hostname navigation#64367
drobison00 merged 4 commits into
openclaw:mainfrom
eleqtrizit:browser-ssrf-guard

eleqtrizit commented Apr 10, 2026

Uh oh!

greptile-apps Bot commented Apr 10, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

eleqtrizit commented Apr 10, 2026

Uh oh!

eleqtrizit commented Apr 10, 2026

Uh oh!

chatgpt-codex-connector Bot commented Apr 10, 2026

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Apr 10, 2026

Uh oh!

chatgpt-codex-connector Bot Apr 10, 2026

Uh oh!

chatgpt-codex-connector Bot Apr 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

eleqtrizit commented Apr 10, 2026

Summary

Changes

Validation

Notes

Uh oh!

greptile-apps Bot commented Apr 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

eleqtrizit commented Apr 10, 2026

Uh oh!

eleqtrizit commented Apr 10, 2026

Uh oh!

chatgpt-codex-connector Bot commented Apr 10, 2026

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

greptile-apps Bot commented Apr 10, 2026 •

edited

Loading