fix(security): escape entry.id in HTML export to prevent attribute XSS by SebTardif · Pull Request #83104 · openclaw/openclaw

SebTardif · 2026-05-17T13:28:48Z

Problem

template.js in the HTML export feature interpolates entry.id directly into HTML attribute strings without escaping:

// Line 1312 (copy-link button)
`<button class="copy-link-btn" data-entry-id="${entryId}" ...>`

// Line 1323 (entry wrapper)
const entryId = `entry-${entry.id}`;

If an entry.id contains double-quote characters (e.g., a crafted conversation export or corrupted data), the quote closes the data-entry-id attribute and the remainder is parsed as new HTML attributes. An attacker-controlled entry.id of x" onmouseover="alert(document.cookie) injects an onmouseover event handler into the DOM.

This is a stored XSS in the HTML export: the payload persists in the exported HTML file and fires whenever a user interacts with the affected element.

Fix

Wrap both entry.id interpolation sites with the existing escapeHtmlAttr() function (already defined in template.js for other attributes):

// Line 1312: escapeHtmlAttr(entryId)
`<button class="copy-link-btn" data-entry-id="${escapeHtmlAttr(entryId)}" ...>`

// Line 1323: escapeHtmlAttr(entry.id)
const entryId = `entry-${escapeHtmlAttr(entry.id)}`;

escapeHtmlAttr replaces ", &, <, >, and ' with their HTML entity equivalents (", &, <, >, '). This prevents quote characters from closing the attribute and injecting new HTML attributes.

Production diff is 2 lines changed in template.js, plus 389 lines of security test coverage.

Real behavior proof

Behavior addressed: entry.id was interpolated raw into HTML attributes in the export template. A crafted entry ID with double quotes broke out of the data-entry-id attribute and injected arbitrary HTML attributes (XSS).

Real environment tested: Linux (Ubuntu 24.04, WSL2), Node.js v22.16.0, Headless Chromium 148.0.7778.96 via Playwright 1.60.0, OpenClaw built from source at /tmp/fix-83104.

Exact steps or command run after this patch:

# 1. Build OpenClaw from patched source
cd /tmp/fix-83104
CI=true pnpm install --frozen-lockfile
pnpm build

# 2. Generate an export HTML with malicious entry.id
# Session data with entry.id = 'x" onmouseover="alert(document.cookie)'
node -e '<generates /tmp/xss-proof-export.html, 247KB>'

# 3. Open the export in headless Chromium via Playwright
# Inspect DOM for onmouseover attributes, hover to trigger, check alerts
node playwright-xss-proof.mjs

# 4. Generate UNPATCHED export (escapeHtmlAttr reverted) for red-green comparison
node -e '<reverts escapeHtmlAttr, generates /tmp/xss-proof-UNPATCHED.html>'
node playwright-xss-before.mjs

Evidence after fix: Chromium browser output copied below.

Chromium red-green proof: XSS payload in entry.id

Generated a full 247KB HTML export with a malicious entry.id of x" onmouseover="alert(document.cookie)". Opened it in headless Chromium 148 via Playwright, queried the DOM for XSS breakout, and hovered elements to trigger any injected event handlers.

AFTER fix (with escapeHtmlAttr) -- Chromium HeadlessChrome/148.0.7778.96:

=== CHROMIUM BROWSER XSS PROOF ===
Browser: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.7778.96 Safari/537.36

Elements with onmouseover handler: 0
XSS breakout: NO -- SAFE

Copy-link buttons found: 2
  data-entry-id: "x\" onmouseover=\"alert(document.cookie)"
  data-entry-id: "safe-2"

Injected alert() scripts: 0

Raw HTML of first copy-link button:
<button class="copy-link-btn" data-entry-id="x&quot; onmouseover=&quot;alert(document.cookie)" title="Copy link to this message">

dataset.entryId (browser-decoded): "x\" onmouseover=\"alert(document.cookie)"
Contains raw quote: YES
Contains onmouseover: YES (but as data, not attribute)

Alert dialog triggered by hovering: NO -- SAFE

The " entities in data-entry-id="x" onmouseover="alert(document.cookie)" keep the entire payload inside the attribute value. Chromium's DOM parser does not create an onmouseover attribute. Hovering all rendered elements triggers no alert dialog. The dataset.entryId API round-trips the value correctly (browser decodes " back to " as data, not as HTML structure).

BEFORE fix (escapeHtmlAttr reverted) -- same Chromium:

=== CHROMIUM BEFORE FIX (escapeHtmlAttr reverted) ===
Browser: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.7778.96 Safari/537.36

Elements with onmouseover handler: 1
XSS breakout: YES -- VULNERABLE

Alert dialog triggered by hovering: YES -- XSS CONFIRMED
Alert message:

Without escapeHtmlAttr, the raw double-quote in entry.id closes the data-entry-id attribute. Chromium parses onmouseover="alert(document.cookie)" as a real DOM attribute. querySelectorAll("[onmouseover]") finds 1 element. Hovering that element triggers alert(document.cookie) -- XSS confirmed in a real browser.

Summary table

Check	After fix	Before fix
`[onmouseover]` elements	0	1
Alert dialog on hover	NO	YES
`data-entry-id` escaping	`"` entities	Raw quote breakout
Injected `alert()` scripts	0	N/A

Compiled code verification

escapeHtmlAttr is present in the compiled production bundle:

$ grep -c "escapeHtmlAttr" dist/format-DbIGvGi1.js
2

Live gateway startup proof

$ timeout 10 node openclaw.mjs gateway
2026-05-21T14:08:04.340-07:00 [gateway] loading configuration…
2026-05-21T14:08:06.725-07:00 [health-monitor] started (interval: 300s)
2026-05-21T14:08:07.656-07:00 [gateway] http server listening (8 plugins; 3.3s)
2026-05-21T14:08:08.174-07:00 [gateway] ready
2026-05-21T14:08:14.016-07:00 [shutdown] completed cleanly in 94ms

Vitest security test suite (10 tests, supplemental)

$ node scripts/run-vitest.mjs src/auto-reply/reply/export-html/template.security.test.ts
 ✓ |auto-reply| template.security.test.ts (10 tests) 169ms
 Test Files  1 passed (1)
      Tests  10 passed (10)

Observed result after fix: Headless Chromium 148 confirms the escapeHtmlAttr() fix prevents XSS breakout. With the fix, 0 elements have onmouseover handlers and no alert dialog fires on hover. Without the fix, 1 element has an onmouseover handler and hovering it triggers alert(document.cookie) in the real Chromium DOM.

What was not tested: Opening the export in Firefox (tested in Chromium only). The HTML attribute escaping is standardized across browsers; Chromium's DOM parser is the reference implementation.

clawsweeper · 2026-05-17T13:29:53Z

Codex review: needs maintainer review before merge.

Workflow note: Future ClawSweeper reviews update this same comment in place.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Summary
The PR escapes exported conversation entry.id values in HTML id and data-entry-id attributes and adds regression tests for attribute breakout plus copy-link round-tripping.

Reproducibility: yes. by source inspection: current main writes raw entry.id into double-quoted HTML attributes before browser parsing. The PR body also includes Chromium red-green output showing breakout before the fix and containment after it.

PR rating
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Summary: The PR has strong real browser proof, a small implementation, and focused regression tests with no concrete blocking findings.

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Real behavior proof
Sufficient (live_output): The PR body includes after-fix Headless Chromium output showing zero injected onmouseover attributes and no alert, plus before-fix Chromium output confirming the exploit path.

Risk before merge

Required CI and maintainer security review still need to gate merge; this read-only pass inspected source, history, diff, and supplied proof but did not run tests locally.

Maintainer options:

Decide the mitigation before merge
Land the narrow escaping fix and regression coverage after maintainer security review and required CI are green or explicitly accepted.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge
No repair lane is needed because the patch appears correct and the remaining action is maintainer security review plus CI and merge handling.

Security
Cleared: The diff narrows an existing exported-HTML XSS sink and does not add dependency, workflow, package, script, permission, or secret-handling surface.

Review details

Best possible solution:

Land the narrow escaping fix and regression coverage after maintainer security review and required CI are green or explicitly accepted.

Do we have a high-confidence way to reproduce the issue?

Yes by source inspection: current main writes raw entry.id into double-quoted HTML attributes before browser parsing. The PR body also includes Chromium red-green output showing breakout before the fix and containment after it.

Is this the best way to solve the issue?

Yes. Reusing the existing escapeHtmlAttr helper at both attribute sinks is the narrowest maintainable fix, and the added tests cover XSS containment plus copy-link ID preservation.

Label justifications:

P2: This is a focused stored-XSS hardening PR for exported HTML with limited production surface and strong proof.
rating: 🦞 diamond lobster: Current PR rating is 🦞 diamond lobster because proof is 🦞 diamond lobster, patch quality is 🦞 diamond lobster, and The PR has strong real browser proof, a small implementation, and focused regression tests with no concrete blocking findings.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes after-fix Headless Chromium output showing zero injected onmouseover attributes and no alert, plus before-fix Chromium output confirming the exploit path.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix Headless Chromium output showing zero injected onmouseover attributes and no alert, plus before-fix Chromium output confirming the exploit path.

What I checked:

Current main raw attribute sinks: Current main builds entry-${entry.id} and interpolates the unescaped entryId into data-entry-id, so quote characters in a crafted entry id can break out of double-quoted attributes before this PR. (src/auto-reply/reply/export-html/template.js:1312, 7cda26aa6c72)
Existing escaping helper: The export template already defines escapeHtmlAttr, which HTML-escapes text and additionally replaces double and single quotes for attribute contexts. (src/auto-reply/reply/export-html/template.js:668, 7cda26aa6c72)
PR implementation: The final PR diff applies escapeHtmlAttr(entryId) to the copy-link button and escapeHtmlAttr(entry.id) while constructing the element id, while still passing raw entry.id into renderCopyLinkButton so browser-decoded dataset values round-trip. (src/auto-reply/reply/export-html/template.js:1312, dc360ad6dac3)
Regression coverage: The PR adds tests that render a malicious entry id, assert no injected script or stray attributes appear, and verify dataset.entryId plus getElementById still round-trip special characters. (src/auto-reply/reply/export-html/template.security.test.ts:497, dc360ad6dac3)
Real behavior proof from PR body: The PR body includes after-fix Headless Chromium output with zero [onmouseover] elements and no alert on hover, plus before-fix Chromium output showing one injected handler and an alert trigger when escaping is reverted. (dc360ad6dac3)
Current-line provenance: Blame ties the current raw interpolation lines and the existing escaping helper in main to the recent export-html snapshot commit. (src/auto-reply/reply/export-html/template.js:1312, 9f2c0a80b40f)

Likely related people:

@vincentkoc: Current-main blame for the export template, renderCopyLinkButton, raw entry.id interpolation, and escapeHtmlAttr points to the recent export-html snapshot commit. (role: recent area contributor; confidence: high; commits: 9f2c0a80b40f; files: src/auto-reply/reply/export-html/template.js, src/auto-reply/reply/export-html/template.security.test.ts)
@steipete: Recent history shows exported-session HTML security hardening, image data-url hardening, and parser/test-surface maintenance in the same export-html area. (role: security hardening and recent adjacent contributor; confidence: high; commits: f8524ec77a39, e578521ef493, 346aa0ed4745; files: src/auto-reply/reply/export-html/template.js, src/auto-reply/reply/export-html/template.security.test.ts)
boris: The export-html templates and /export-session command were originally bundled into the repository in this commit, making this a relevant provenance point for the feature boundary. (role: introduced export-html bundle; confidence: medium; commits: f70b3a2e6878, add3afb7439e; files: src/auto-reply/reply/export-html/template.js, src/auto-reply/reply/commands-export-session.ts)

Codex review notes: model gpt-5.5, reasoning high; reviewed against 7cda26aa6c72.

…aw#83104) Signed-off-by: Sebastien Tardif <[email protected]>

clawsweeper · 2026-05-20T06:57:00Z

ClawSweeper PR egg

✨ Hatched: 🥚 common Gilded Crabkin

Hatch command

Comment @clawsweeper hatch when this PR is hatchable.

Hatchability rules:

Merged PRs are hatchable.
Open PRs are hatchable when they are status: 👀 ready for maintainer look, status: 🚀 automerge armed, or labeled clawsweeper:automerge.
Closed unmerged PRs are hatchable only when one of those hatchable labels is still present in the durable record.

Rarity: 🥚 common.
Trait: purrs at green checks.
Image traits: location green-check meadow; accessory shell-shaped keyboard; palette coral, mint, and warm cream; mood mischievous; pose stepping out of a freshly hatched shell; shell polished stone shell; lighting gentle morning glow; background subtle branch markers.
Share on X: post this hatch
Copy: My PR egg hatched a 🥚 common Gilded Crabkin in ClawSweeper.

What is this egg doing here?

Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
Hatchability usually comes from sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness. A merged PR is already final, so merge makes the egg hatchable independently.
The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.

SebTardif · 2026-05-21T15:17:07Z

@clawsweeper re-review

clawsweeper · 2026-05-21T15:19:19Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26235253769
Updated: 2026-05-21T15:28:03.288Z

SebTardif · 2026-05-21T16:36:06Z

@clawsweeper re-review

clawsweeper · 2026-05-21T19:29:21Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26255770199
Updated: 2026-05-21T22:10:11.030Z

SebTardif · 2026-05-21T21:09:48Z

@clawsweeper re-review

SebTardif · 2026-05-21T21:42:50Z

@clawsweeper re-review

steipete · 2026-05-22T20:26:49Z

Verification before merge: pnpm test src/auto-reply/reply/export-html/template.security.test.ts (10 passed); autoreview clean. Scope: HTML export template escapes entry IDs in attributes while preserving decoded DOM lookup behavior.

openclaw#83104) * fix(security): escape entry.id in HTML export to prevent attribute XSS Apply escapeHtmlAttr to entry.id in renderEntry and renderCopyLinkButton to prevent attribute injection via crafted entry IDs in HTML exports. Signed-off-by: Sebastien Tardif <[email protected]> * chore: remove proof helper scripts from branch ClawSweeper P2: committed proof scripts can provide false-positive validation. Proof output is in the PR body instead. Signed-off-by: Sebastien Tardif <[email protected]> --------- Signed-off-by: Sebastien Tardif <[email protected]>

16826 drift commits, 150 flagged (security/regression keywords). Notable: XSS fix (openclaw#83104), security floor fixes, session-visibility glob fix. Report: _tagai/monitoring/UPSTREAM_2026-05-25.md

openclaw#83104) * fix(security): escape entry.id in HTML export to prevent attribute XSS Apply escapeHtmlAttr to entry.id in renderEntry and renderCopyLinkButton to prevent attribute injection via crafted entry IDs in HTML exports. Signed-off-by: Sebastien Tardif <[email protected]> * chore: remove proof helper scripts from branch ClawSweeper P2: committed proof scripts can provide false-positive validation. Proof output is in the PR body instead. Signed-off-by: Sebastien Tardif <[email protected]> --------- Signed-off-by: Sebastien Tardif <[email protected]>

26194 drift commits, 222 flagged (security/regression keywords). Notable: XSS fix (openclaw#83104), PATH injection (openclaw#73264), npm_execpath injection (openclaw#73262), implicit tool grant fix (openclaw#75055), payment credential redaction (openclaw#75230), heartbeat regression (openclaw#88970).

openclaw-barnacle Bot added size: XS triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 17, 2026

clawsweeper Bot added P2 Normal backlog priority with limited blast radius. impact:security Security boundary, credential, authz, sandbox, or sensitive-data risk. labels May 17, 2026

openclaw-barnacle Bot added proof: supplied External PR includes structured after-fix real behavior proof. and removed triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 17, 2026

SebTardif added a commit to SebTardif/openclaw that referenced this pull request May 20, 2026

test: add XSS regression test for entry.id attribute escaping (opencl…

b4f5ce3

…aw#83104) Signed-off-by: Sebastien Tardif <[email protected]>

openclaw-barnacle Bot added size: S triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. and removed size: XS proof: supplied External PR includes structured after-fix real behavior proof. labels May 20, 2026

openclaw-barnacle Bot added proof: supplied External PR includes structured after-fix real behavior proof. and removed triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 20, 2026

clawsweeper Bot added the merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. label May 20, 2026

openclaw-barnacle Bot added triage: mock-only-proof Candidate: PR proof only shows tests, mocks, snapshots, lint, typecheck, or CI. and removed proof: supplied External PR includes structured after-fix real behavior proof. labels May 21, 2026

SebTardif force-pushed the fix/xss-escape-entry-id branch from b4f5ce3 to 7c33eb4 Compare May 21, 2026 15:17

clawsweeper Bot removed the merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. label May 21, 2026

openclaw-barnacle Bot added triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. and removed triage: mock-only-proof Candidate: PR proof only shows tests, mocks, snapshots, lint, typecheck, or CI. labels May 21, 2026

SebTardif force-pushed the fix/xss-escape-entry-id branch from 7c33eb4 to 42574d8 Compare May 21, 2026 16:36

openclaw-barnacle Bot removed the size: S label May 21, 2026

openclaw-barnacle Bot added size: S and removed scripts Repository scripts size: M labels May 21, 2026

clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels May 21, 2026

steipete merged commit 7bc4a33 into openclaw:main May 22, 2026
147 of 163 checks passed

github-actions Bot mentioned this pull request May 22, 2026

📡 Upstream Digest — 2026-05-22 21:03 UTC curtismercier/openclaw-mods#919

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(security): escape entry.id in HTML export to prevent attribute XSS#83104

fix(security): escape entry.id in HTML export to prevent attribute XSS#83104
steipete merged 2 commits into
openclaw:mainfrom
SebTardif:fix/xss-escape-entry-id

SebTardif commented May 17, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 17, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 20, 2026 •

edited

Loading

Uh oh!

SebTardif commented May 21, 2026

Uh oh!

clawsweeper Bot commented May 21, 2026 •

edited

Loading

Uh oh!

SebTardif commented May 21, 2026

Uh oh!

clawsweeper Bot commented May 21, 2026 •

edited

Loading

Uh oh!

SebTardif commented May 21, 2026

Uh oh!

SebTardif commented May 21, 2026

Uh oh!

steipete commented May 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

SebTardif commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Fix

Real behavior proof

Chromium red-green proof: XSS payload in entry.id

Summary table

Compiled code verification

Live gateway startup proof

Vitest security test suite (10 tests, supplemental)

Uh oh!

clawsweeper Bot commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Hatch command

Uh oh!

SebTardif commented May 21, 2026

Uh oh!

clawsweeper Bot commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

SebTardif commented May 21, 2026

Uh oh!

clawsweeper Bot commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

SebTardif commented May 21, 2026

Uh oh!

SebTardif commented May 21, 2026

Uh oh!

steipete commented May 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

SebTardif commented May 17, 2026 •

edited

Loading

clawsweeper Bot commented May 17, 2026 •

edited

Loading

clawsweeper Bot commented May 20, 2026 •

edited

Loading

clawsweeper Bot commented May 21, 2026 •

edited

Loading

clawsweeper Bot commented May 21, 2026 •

edited

Loading