openclaw - 💡(How to fix) Fix No test coverage for security-sensitive restart-script generation

Severity: high / Confidence: high / Category: test-gap Triage: test-gap Detected against: openclaw v2026.5.18 (latest stable at time of scan, 2026-05-18) Tooling: clawpatch 0.3.0 + acpx/claude-sonnet-4-5 via Brad Mills protocol (https://x.com/bradmillscan/status/2056377217437909178)

Evidence

• src/cli/update-cli/restart-helper.ts:1-10 (prepareRestartScript)

export async function prepareRestartScript(

• src/cli/update-cli/restart-helper.ts:22-35 (shellEscape)

function shellEscape(value: string): string {
  return value.replace(/'/g, "'\\''")
}

/** Validates a task name is safe for embedding in Windows restart scripts. */
function isWindowsTaskNameSafe(value: string): boolean {
  return /^[A-Za-z0-9 _\-().]+$/.test(value)
}

Reasoning

prepareRestartScript generates platform-specific shell/PowerShell/batch scripts that embed user-controlled values (launchd label, systemd unit name, Windows task name, HOME path, port). Shell-escape correctness (shellEscape, powerShellSingleQuote, isWindowsTaskNameSafe) has zero test coverage. A regression in any escape routine could introduce shell injection at the moment the gateway restarts after a core update — a highly privileged code path. The feature lists no tests at all.

Reproduction

No regression test file exists; any change to shellEscape or isWindowsTaskNameSafe goes unverified.

Recommendation

Add unit tests covering: (1) shellEscape with embedded single-quotes; (2) powerShellSingleQuote with embedded single-quotes; (3) isWindowsTaskNameSafe rejects names with semicolons, pipes, quotes, backticks; (4) prepareRestartScript round-trips a label containing a single-quote and verifies the generated script contains no unescaped injection. These can be pure-function unit tests without spawning child processes.

Why existing tests miss this

The feature test list is empty; no test file for this module exists in the repo surface visible here.

Suggested regression test

describe('shellEscape', () => { it('escapes single quotes', () => { expect(shellEscape("foo'bar")).toBe("foo'\''bar"); }); }); describe('isWindowsTaskNameSafe', () => { it('rejects semicolons', () => expect(isWindowsTaskNameSafe('Task;Evil')).toBe(false)); it('rejects pipes', () => expect(isWindowsTaskNameSafe('Task|Evil')).toBe(false)); });

Minimum fix scope

Add a colocated restart-helper.test.ts covering the three escape/validation helpers and at least the happy-path output of prepareRestartScript for each platform.

Standardized clawpatch finding submission. Persistent across v2026.5.12 → v2026.5.18 — not resolved by upgrading. Finding ID: fnd_sig-feat-cli-command-0e1f16a0ce-_3b3408f6dd.