Description

The exported reconcileWorkspaceBootstrapCompletion(dir) function performs filesystem writes and deletions in the caller-provided directory without ensuring the directory is an expected/safe workspace root.

• Input: dir parameter (string) is resolved via resolveUserPath, which expands ~ and resolves the path but does not restrict it to an application-controlled workspace directory.
• Sinks:
  • Deletes ${dir}/BOOTSTRAP.md via fs.rm(..., { force: true })
  • Creates/overwrites ${dir}/.openclaw/workspace-state.json via writeWorkspaceSetupState() (mkdir + writeFile + rename)
• If any external surface (CLI arg, API request, plugin input, etc.) can influence dir, an attacker can point it at arbitrary filesystem locations (including sensitive directories) and cause unintended modification/deletion.

Vulnerable code (core sink):

await fs.rm(params.bootstrapPath, { force: true });
await writeWorkspaceSetupState(params.statePath, repairedState);

Recommendation

Restrict operations to an application-controlled workspace root and defend against symlink/path escape.

• Require dir to be under DEFAULT_AGENT_WORKSPACE_DIR (or another configured workspace root), using realpath/canonicalization checks.
• Consider reusing the existing boundary-guard pattern (e.g., openBoundaryFile) for writes/deletes as well.

Example mitigation:

import fsSync from "node:fs";
import path from "node:path";

function assertUnderRoot(targetDir: string, rootDir: string) {
  const rootReal = fsSync.realpathSync(rootDir);
  const targetReal = fsSync.realpathSync(targetDir);
  const rel = path.relative(rootReal, targetReal);
  if (rel.startsWith("..") || path.isAbsolute(rel)) {
    throw new Error(`Unsafe workspace dir: ${targetDir}`);
  }
}

export async function reconcileWorkspaceBootstrapCompletion(dir: string) {
  const resolvedDir = resolveUserPath(dir);
  assertUnderRoot(resolvedDir, DEFAULT_AGENT_WORKSPACE_DIR);
  ​// ... proceed
}

Additionally, avoid force: true unless necessary, and ensure callers cannot supply arbitrary paths.

Description

The workspace bootstrap reconciliation and state persistence logic performs file deletion and file writes in a user-chosen workspace directory without protecting against symlink/hardlink attacks.

Impacts:

• Arbitrary file overwrite (within process permissions): writeWorkspaceSetupState writes a temp file and then rename()s it into statePath. If the .openclaw directory (or statePath) is a symlink pointing outside the workspace, the code can end up writing workspace-state.json into an unintended location.
• Arbitrary file deletion (within process permissions): reconcileWorkspaceBootstrapCompletionState calls fs.rm(bootstrapPath, { force: true }). If an attacker can replace BOOTSTRAP.md with a hardlink to another file writable by the process, unlinking it may delete the target file (or at least remove a link to it).

Vulnerable code:

await fs.rm(params.bootstrapPath, { force: true });
...
await fs.mkdir(path.dirname(statePath), { recursive: true });
await fs.writeFile(tmpPath, payload, { encoding: "utf-8" });
await fs.rename(tmpPath, statePath);

This can be triggered during normal workspace startup paths, including legacy migration persistence (persistLegacyMigration: true).

Recommendation

Harden workspace file operations against symlink/hardlink attacks:

1. Refuse symlinks for security-sensitive paths (BOOTSTRAP.md, .openclaw, workspace-state.json). Use lstat() (not stat()) and reject if isSymbolicLink().
2. Ensure paths stay within the intended workspace: resolve realpath() of dir and of path.dirname(statePath) and verify the latter starts with the former.
3. Write state atomically without following symlinks (best-effort in Node): open the destination with O_NOFOLLOW (where supported) and write via file descriptor; alternatively, create .openclaw with safe permissions at workspace creation time and reject if it already exists but is not a real directory.
4. Before deletion, verify BOOTSTRAP.md is a regular file and (optionally) that its link count is 1 to reduce hardlink risk.

Example hardening (POSIX-oriented, adjust for platform support):

import { constants as FS } from "node:fs";

async function assertNoSymlink(p: string) {
  const st = await fs.lstat(p).catch((e) => {
    if (e?.code === "ENOENT") return null;
    throw e;
  });
  if (st?.isSymbolicLink()) throw new Error(`Refusing to follow symlink: ${p}`);
}

await assertNoSymlink(path.join(dir, ".openclaw"));
await assertNoSymlink(statePath);
await assertNoSymlink(bootstrapPath);

If you need to support pre-existing workspaces, treat symlinked .openclaw/state files as an error and require user intervention rather than writing through them.

Description

fileContentDiffersFromTemplate() reads entire onboarding profile files into memory using fs.readFile(..., "utf-8") with no size checks. This is invoked during ensureAgentWorkspace() legacy migration and via reconcileWorkspaceBootstrapCompletionState() when deciding whether a stale BOOTSTRAP.md indicates onboarding completion.

Impact:

• An attacker who can write to the workspace directory (e.g., via the gateway method agents.files.set for SOUL.md/IDENTITY.md/USER.md, or any local/untrusted workspace content) can place extremely large files at these paths.
• On startup/bootstrapping, the agent will attempt to read these files fully into memory (and do so in parallel across 3 files), which can lead to high memory usage, process slowdown, or crash (denial of service).

Vulnerable code:

return (await fs.readFile(filePath, "utf-8")) !== template;

Recommendation

Add a maximum size guard before reading, and avoid loading entire files when you only need to know whether they match the template.

Example fix (size check + bounded read):

const MAX_PROFILE_BYTES = 128 * 1024; // tune as appropriate

async function fileContentDiffersFromTemplate(filePath: string, template: string): Promise<boolean> {
  try {
    const st = await fs.stat(filePath);
    if (!st.isFile()) return false;
    if (st.size > MAX_PROFILE_BYTES) {
      ​// treat as "configured" without reading whole file (or handle as error)
      return true;
    }
    const content = await fs.readFile(filePath, "utf-8");
    return content !== template;
  } catch (err) {
    const anyErr = err as { code?: string };
    if (anyErr.code !== "ENOENT") throw err;
    return false;
  }
}

Alternatively, compare via streaming/hash to avoid full buffering, and consider applying similar limits anywhere workspace files are read during bootstrap.

1. src/agents/workspace.ts, line 358-378 (link)

   resolveWorkspaceBootstrapStatus now has an implicit write side-effect

   Before this PR, resolveWorkspaceBootstrapStatus was a pure read — any caller could rely on it being non-mutating. It now conditionally deletes BOOTSTRAP.md and persists setupCompletedAt via repairStaleWorkspaceBootstrapCompletion. Callers like Control UI, TUI, or /new that call this function for a status check will silently mutate workspace state as a side-effect of reading. This is the intended repair behavior per the PR, but the function name ("resolve") gives no hint of the potential writes. A doc comment capturing the repair-on-first-call semantics would prevent future callers from being caught off guard.

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: src/agents/workspace.ts
   Line: 358-378
   
   Comment:
   **`resolveWorkspaceBootstrapStatus` now has an implicit write side-effect**
   
   Before this PR, `resolveWorkspaceBootstrapStatus` was a pure read — any caller could rely on it being non-mutating. It now conditionally deletes `BOOTSTRAP.md` and persists `setupCompletedAt` via `repairStaleWorkspaceBootstrapCompletion`. Callers like Control UI, TUI, or `/new` that call this function for a status check will silently mutate workspace state as a side-effect of reading. This is the intended repair behavior per the PR, but the function name ("resolve") gives no hint of the potential writes. A doc comment capturing the repair-on-first-call semantics would prevent future callers from being caught off guard.
   
   How can I resolve this? If you propose a fix, please make it concise.