@a1hvdy/cc-openclaw 0.3.2

package/vendor/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,oDAAoD;AACpD,MAAM,CAAC,MAAM,aAAa,GAA2B,UAAU,EAAE,CAAC"}

package/vendor/validation.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Shared validation utilities for input sanitization.
+ *
+ * Used by both the plugin tool handlers (index.ts) and the embedded HTTP
+ * server (embedded-server.ts) to ensure consistent protection regardless
+ * of entry point.
+ */
+/**
+ * Resolve and validate a working directory path.
+ *
+ * Prevents path traversal and blocks access to system-critical and
+ * sensitive directories. Resolves symlinks where possible to defeat
+ * symlink-based bypasses.
+ */
+export declare function sanitizeCwd(cwd: string | undefined): string | undefined;
+/**
+ * Validate that a string is a syntactically valid regular expression.
+ *
+ * Returns the compiled RegExp if valid, throws on invalid syntax.
+ * Note: this validates syntax only — it does not detect catastrophic
+ * backtracking (ReDoS) patterns.
+ */
+export declare function validateRegex(pattern: string): RegExp;
+/**
+ * Validate a resource name (agent, skill, rule) to prevent path injection.
+ *
+ * Only allows alphanumeric characters, hyphens, and underscores.
+ * Rejects empty strings, dots, slashes, spaces, and any other characters
+ * that could be used for path traversal.
+ */
+export declare function validateName(name: string): string;

package/vendor/validation.js

@@ -0,0 +1,104 @@
+/**
+ * Shared validation utilities for input sanitization.
+ *
+ * Used by both the plugin tool handlers (index.ts) and the embedded HTTP
+ * server (embedded-server.ts) to ensure consistent protection regardless
+ * of entry point.
+ */
+import * as path from 'node:path';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+// ─── Blocked Path Prefixes ─────────────────────────────────────────────────
+/** System-critical directories that must never be used as a working directory */
+const BLOCKED_PREFIXES = ['/etc', '/proc', '/sys', '/var/run', '/var/log', '/boot', '/sbin'];
+/** Sensitive directories under the user's home that must never be used as cwd */
+const BLOCKED_HOME_SUBDIRS = ['.ssh', '.gnupg', '.aws', '.config/gcloud'];
+// ─── sanitizeCwd ────────────────────────────────────────────────────────────
+/**
+ * Resolve and validate a working directory path.
+ *
+ * Prevents path traversal and blocks access to system-critical and
+ * sensitive directories. Resolves symlinks where possible to defeat
+ * symlink-based bypasses.
+ */
+export function sanitizeCwd(cwd) {
+    if (!cwd)
+        return undefined;
+    // Logical path: resolves .. and . but does NOT follow symlinks.
+    // This catches the obvious cases (/etc, /var/run, /sbin) on all platforms.
+    const logical = path.resolve(cwd);
+    // Real path: follows symlinks. This catches symlink-based bypasses
+    // (e.g. /tmp/safe → /etc). Falls back to logical for non-existent paths.
+    let real;
+    try {
+        real = fs.realpathSync(cwd);
+    }
+    catch {
+        real = logical;
+    }
+    // Collect all paths to check — logical, real, and their de-prefixed
+    // variants for macOS where /etc → /private/etc, /var → /private/var.
+    const pathsToCheck = new Set([logical, real]);
+    for (const p of [logical, real]) {
+        if (p.startsWith('/private/')) {
+            pathsToCheck.add(p.slice('/private'.length));
+        }
+    }
+    // Block filesystem root
+    for (const check of pathsToCheck) {
+        if (check === '/') {
+            throw new Error(`Unsafe working directory: ${logical}`);
+        }
+    }
+    // Block system-critical prefixes
+    for (const check of pathsToCheck) {
+        for (const prefix of BLOCKED_PREFIXES) {
+            if (check === prefix || check.startsWith(prefix + '/')) {
+                throw new Error(`Unsafe working directory: ${logical}`);
+            }
+        }
+    }
+    // Block sensitive home subdirectories
+    const home = os.homedir();
+    for (const check of pathsToCheck) {
+        for (const subdir of BLOCKED_HOME_SUBDIRS) {
+            const sensitive = path.join(home, subdir);
+            if (check === sensitive || check.startsWith(sensitive + '/')) {
+                throw new Error(`Unsafe working directory: ${logical}`);
+            }
+        }
+    }
+    return real;
+}
+// ─── validateRegex ──────────────────────────────────────────────────────────
+/**
+ * Validate that a string is a syntactically valid regular expression.
+ *
+ * Returns the compiled RegExp if valid, throws on invalid syntax.
+ * Note: this validates syntax only — it does not detect catastrophic
+ * backtracking (ReDoS) patterns.
+ */
+export function validateRegex(pattern) {
+    try {
+        return new RegExp(pattern, 'i');
+    }
+    catch (err) {
+        throw new Error(`Invalid regex pattern: ${err.message}`);
+    }
+}
+// ─── validateName ───────────────────────────────────────────────────────────
+const VALID_NAME = /^[a-zA-Z0-9_-]+$/;
+/**
+ * Validate a resource name (agent, skill, rule) to prevent path injection.
+ *
+ * Only allows alphanumeric characters, hyphens, and underscores.
+ * Rejects empty strings, dots, slashes, spaces, and any other characters
+ * that could be used for path traversal.
+ */
+export function validateName(name) {
+    if (!name || !VALID_NAME.test(name)) {
+        throw new Error(`Invalid name '${name}': must be non-empty and match /^[a-zA-Z0-9_-]+$/`);
+    }
+    return name;
+}
+//# sourceMappingURL=validation.js.map

package/vendor/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/validation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,8EAA8E;AAE9E,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAE7F,iFAAiF;AACjF,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAE1E,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,GAAuB;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAE3B,gEAAgE;IAChE,2EAA2E;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAElC,mEAAmE;IACnE,yEAAyE;IACzE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,OAAO,CAAC;IACjB,CAAC;IAED,oEAAoE;IACpE,qEAAqE;IACrE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9B,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACtC,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,KAAK,MAAM,MAAM,IAAI,oBAAoB,EAAE,CAAC;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC1C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,GAAG,GAAG,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,IAAI,CAAC;QACH,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAEtC;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,mDAAmD,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}