Repository navigation
fix(security): replace process.env spread with allowlist in blueprint runner #1874
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,21 +2,19 @@ | |
| <!-- SPDX-License-Identifier: Apache-2.0 --> | ||
| # Workspace Files | ||
|
|
||
| OpenClaw stores its personality, user context, and behavioral configuration in a set of Markdown files inside the sandbox. | ||
| These files live at `/sandbox/.openclaw/workspace/` and are collectively called **workspace files**. | ||
|
|
||
| ## File Reference | ||
|
|
||
| | File | Purpose | | ||
| |---|---| | ||
| | `SOUL.md` | Defines the agent's persona, tone, and communication style. | | ||
| | `USER.md` | Stores information about the human the agent assists. | | ||
| | `IDENTITY.md` | Short identity card — name, language, emoji, creature type. | | ||
| | `AGENTS.md` | Behavioral rules, memory conventions, safety guidelines, and session workflow. | | ||
| | `MEMORY.md` | Curated long-term memory distilled from daily notes. | | ||
| | `memory/` | Directory of daily note files (`YYYY-MM-DD.md`) for session continuity. | | ||
|
|
||
| ## Where They Live | ||
|
|
||
|
|
@@ -34,30 +32,32 @@ All workspace files reside inside the sandbox filesystem: | |
| └── 2026-03-19.md | ||
| ``` | ||
|
|
||
| ## Persistence Behavior | ||
|
|
||
| Understanding when these files persist and when they are lost is critical. | ||
|
|
||
| ### Survives: Sandbox Restart | ||
|
|
||
| Sandbox restarts (`openshell sandbox restart`) preserve workspace files. | ||
| The sandbox uses a **Persistent Volume Claim (PVC)** that outlives individual container restarts. | ||
|
|
||
| ### Lost: Sandbox Destroy | ||
|
|
||
| Running `nemoclaw <name> destroy` **deletes the sandbox and its PVC**. | ||
| All workspace files are permanently lost unless you back them up first. | ||
|
|
||
| > **Warning:** Always back up your workspace files before running `nemoclaw <name> destroy`. | ||
| > See Backup and Restore (see the `nemoclaw-user-workspace` skill) for instructions. | ||
|
|
||
| ## Editing Workspace Files | ||
|
|
||
| The agent reads these files at the start of every session. | ||
| You can edit them in two ways: | ||
|
|
||
| 1. **Let the agent do it** — Ask your agent to update its persona, memory, or user context. | ||
| 2. **Edit manually** — Use `openshell sandbox shell` to open a terminal inside the sandbox and edit files directly, or use `openshell sandbox upload` to push edited files from your host. | ||
|
|
||
| ## Next Steps | ||
|
|
||
| - Backup and Restore workspace files (see the `nemoclaw-user-workspace` skill) | ||
| - Commands reference (see the `nemoclaw-user-reference` skill) | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -430,6 +430,48 @@ describe("runner", () => { | |
| expect(providerCall[1]).not.toContain("--credential"); | ||
| }); | ||
|
|
||
| it("does not leak parent secrets into subprocess env", async () => { | ||
| process.env.MY_API_KEY = "secret-key-123"; | ||
| process.env.GITHUB_TOKEN = "ghp_leaked"; | ||
| process.env.AWS_ACCESS_KEY_ID = "AKIA_leaked"; | ||
| process.env.NVIDIA_API_KEY = "nvapi-leaked"; | ||
| process.env.HTTPS_PROXY = "http://proxy.corp:8080"; | ||
| process.env.OPENSHELL_DEBUG = "1"; | ||
| try { | ||
| await actionApply("default", minimalBlueprint()); | ||
|
|
||
| const providerCall = mockExeca.mock.calls.find( | ||
| (c) => Array.isArray(c[1]) && c[1].includes("provider"), | ||
| ); | ||
| if (!providerCall) throw new Error("provider create call not found"); | ||
| const subEnv = providerCall[2].env; | ||
|
|
||
| // The explicitly injected credential must be present | ||
| expect(subEnv.OPENAI_API_KEY).toBe("secret-key-123"); | ||
|
|
||
| // Secrets from the parent process must NOT be present | ||
| expect(subEnv).not.toHaveProperty("GITHUB_TOKEN"); | ||
| expect(subEnv).not.toHaveProperty("AWS_ACCESS_KEY_ID"); | ||
| expect(subEnv).not.toHaveProperty("NVIDIA_API_KEY"); | ||
| expect(subEnv).not.toHaveProperty("MY_API_KEY"); | ||
|
|
||
| // Allowed system vars should still be present | ||
| expect(subEnv).toHaveProperty("PATH"); | ||
| expect(subEnv).toHaveProperty("HOME"); | ||
|
|
||
| // Proxy, TLS, and openshell vars must pass through | ||
| expect(subEnv.HTTPS_PROXY).toBe("http://proxy.corp:8080"); | ||
| expect(subEnv.OPENSHELL_DEBUG).toBe("1"); | ||
| } finally { | ||
| delete process.env.MY_API_KEY; | ||
| delete process.env.GITHUB_TOKEN; | ||
| delete process.env.AWS_ACCESS_KEY_ID; | ||
| delete process.env.NVIDIA_API_KEY; | ||
| delete process.env.HTTPS_PROXY; | ||
| delete process.env.OPENSHELL_DEBUG; | ||
| } | ||
| }); | ||
|
|
||
| it("falls back to credential_default when env var is unset", async () => { | ||
| const bp = { | ||
| components: { | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -21,6 +21,7 @@ import { execa } from "execa"; | |
| import YAML from "yaml"; | ||
|
|
||
| import { validateEndpointUrl } from "./ssrf.js"; | ||
| import { buildSubprocessEnv } from "../lib/subprocess-env.js"; | ||
| import { DASHBOARD_PORT } from "../lib/ports.js"; | ||
|
|
||
| type Action = "plan" | "apply" | "status" | "rollback"; | ||
|
|
@@ -294,7 +295,7 @@ export async function actionApply( | |
| reject: false, | ||
| stdout: "pipe", | ||
| stderr: "pipe", | ||
| env: buildSubprocessEnv(credEnv), | ||
| }); | ||
|
|
||
| progress(70, "Setting inference route"); | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| /** | ||
| * Subprocess environment allowlist. | ||
| * | ||
| * Subprocesses spawned by the CLI or plugin must NOT inherit the full | ||
| * parent process.env — that leaks secrets (NVIDIA_API_KEY, GITHUB_TOKEN, | ||
| * AWS_ACCESS_KEY_ID, etc.) to child processes where they can be read and | ||
| * exfiltrated. Instead, only forward the categories below. | ||
| * | ||
| * Credentials needed by a subprocess are injected explicitly via the | ||
| * `extra` parameter. | ||
| * | ||
| * See: #1874 | ||
| * | ||
| * NOTE: src/lib/subprocess-env.ts is a mirror of this file for the CLI | ||
| * project. Keep them in sync. | ||
| */ | ||
|
|
||
| // ── Allowed individual names ─────────────────────────────────── | ||
|
|
||
| const SYSTEM = ["HOME", "USER", "LOGNAME", "SHELL", "PATH", "TERM", "HOSTNAME", "NODE_ENV"]; | ||
|
|
||
| const TEMP = ["TMPDIR", "TMP", "TEMP"]; | ||
|
|
||
| const LOCALE = ["LANG"]; // LC_* handled via prefix | ||
|
|
||
| const PROXY = ["HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY", "http_proxy", "https_proxy", "no_proxy"]; | ||
|
|
||
| const TLS = ["SSL_CERT_FILE", "SSL_CERT_DIR", "NODE_EXTRA_CA_CERTS"]; | ||
|
|
||
| const TOOLCHAIN = ["DOCKER_HOST", "KUBECONFIG", "SSH_AUTH_SOCK", "RUST_LOG", "RUST_BACKTRACE"]; | ||
|
|
||
| const ALLOWED_ENV_NAMES = new Set([...SYSTEM, ...TEMP, ...LOCALE, ...PROXY, ...TLS, ...TOOLCHAIN]); | ||
|
|
||
| // ── Allowed prefixes ─────────────────────────────────────────── | ||
|
|
||
| const ALLOWED_ENV_PREFIXES = ["LC_", "XDG_", "OPENSHELL_", "GRPC_"]; | ||
|
|
||
| // ── Public API ───────────────────────────────────────────────── | ||
|
|
||
| export function buildSubprocessEnv(extra?: Record<string, string>): Record<string, string> { | ||
| const env: Record<string, string> = {}; | ||
| for (const [key, value] of Object.entries(process.env)) { | ||
| if (value === undefined) continue; | ||
| if (ALLOWED_ENV_NAMES.has(key) || ALLOWED_ENV_PREFIXES.some((p) => key.startsWith(p))) { | ||
| env[key] = value; | ||
| } | ||
| } | ||
| if (extra) { | ||
| Object.assign(env, extra); | ||
| } | ||
| return env; | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2679,6 +2679,11 @@ async function createSandbox( | |
| // proxy rewrites Authorization headers with real secrets at egress. | ||
| // See: crates/openshell-sandbox/src/secrets.rs (placeholder rewriting), | ||
| // crates/openshell-router/src/backend.rs (inference auth injection). | ||
| // | ||
| // TODO: migrate this blocklist to the shared allowlist in | ||
| // src/lib/subprocess-env.ts once the sandbox create path has been validated | ||
| // end-to-end with the stricter filtering. The allowlist rejects unknown | ||
| // env vars by default, which is safer but needs careful rollout. | ||
| const envArgs = [formatEnvAssignment("CHAT_UI_URL", chatUiUrl)]; | ||
| const blockedSandboxEnvNames = new Set([ | ||
| // Derived from REMOTE_PROVIDER_CONFIG to prevent drift | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -14,6 +14,7 @@ import { | |
| import { join } from "node:path"; | ||
|
|
||
| import { DASHBOARD_PORT } from "./ports"; | ||
| import { buildSubprocessEnv } from "./subprocess-env"; | ||
|
|
||
| // --------------------------------------------------------------------------- | ||
| // Types | ||
|
|
@@ -126,7 +127,7 @@ function startService( | |
| const subprocess = spawn(command, args, { | ||
| detached: true, | ||
| stdio: ["ignore", logFd, logFd], | ||
| env: buildSubprocessEnv(env), | ||
| }); | ||
| closeSync(logFd); | ||
|
|
||
|
|
||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Fix grammar in frontmatter description.
Line 3 has typos (“Hows”, “Whats”) and reads ungrammatically. This is user-facing metadata and should be corrected in the docs source, then regenerated into this skill file.
✍️ Suggested text
📝 Committable suggestion
🤖 Prompt for AI Agents