Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Security]: Config API redaction does not cover browser.cdpUrl paths [2 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#67656•Fetched 2026-04-17 08:29:58
View on GitHub
Comments
0
Participants
1
Timeline
9
Reactions
0
Author
Ziy1-TanZiy1-Tan
Participants
Ziy1-TanZiy1-Tan
Timeline (top)
referenced ×6cross-referenced ×3

Fix Action

Fixed

PR fix notes

PR #67679: fix: redact credentials in browser.cdpUrl config paths

Description (problem / solution / changelog)

What

Add browser.cdpUrl and browser.profiles.*.cdpUrl to the set of config paths recognized as sensitive URLs, so embedded credentials (query tokens like ?token=xxx and HTTP Basic auth user:pass@host) are properly redacted in config.get API responses.

Also regenerate the base schema artifact so shipped uiHints stay aligned with the updated sensitive-URL matcher and continue to expose the correct url-secret metadata for the new cdpUrl paths.

Why

Browser CDP URLs can embed authentication credentials in two documented formats:

  • Query token: https://chrome.browserless.io?token=<secret>
  • HTTP Basic auth: https://user:[email protected]

These paths bypassed all three redaction gates:

  1. Schema .register(sensitive) — not registered
  2. Path-name pattern match (/token$/i, /api.?key$/i, …) — cdpUrl does not match
  3. URL-path match (.baseUrl, .httpUrl, mcp.servers.*.url) — .cdpUrl was not listed

Fixes #67656.

Changes

  • src/shared/net/redact-sensitive-url.ts — Add .cdpUrl suffix check to isSensitiveUrlConfigPath() (3 lines)
  • src/shared/net/redact-sensitive-url.test.ts — Unit tests for isSensitiveUrlConfigPath() with cdpUrl paths
  • src/config/redact-snapshot.test.ts — Snapshot redact/restore round-trip tests covering:
    • browser.cdpUrl with query token + HTTP Basic auth
    • browser.profiles.*.cdpUrl with per-profile credentials
    • Bare cdpUrl addresses without credentials remain unchanged
  • src/config/schema.base.generated.ts — Regenerated the base schema artifact so shipped uiHints include url-secret metadata for browser.cdpUrl and browser.profiles.*.cdpUrl

Testing

  • pnpm build ✅
  • pnpm check ✅
  • node --import tsx scripts/generate-base-config-schema.ts --check ✅
  • All 49 related tests pass (8 unit + 41 snapshot)
  • Tested: fully tested
Test CaseExpectedActualPASS
isSensitiveUrlConfigPath() recognizes .cdpUrlBoth cdpUrl paths treated as sensitiveUnit test passes✅
Redact browser.cdpUrl credentialsSecrets stripped, safe parts keptSnapshot passes (token + Basic auth)✅
Redact browser.profiles.*.cdpUrl credentialsProfile secrets stripped, round-trip safeSnapshot passes✅
Regenerated base schema artifacturl-secret tag on both cdpUrl paths--check passes after regeneration✅

AI Disclosure

This PR was AI-assisted (CodeBuddy / Claude). All code has been reviewed and understood by the author. Tests were written in TDD style (failing test first, then minimal implementation).

Changed files

  • src/config/redact-snapshot.test.ts (modified, +92/-0)
  • src/config/schema.base.generated.ts (modified, +2/-2)
  • src/shared/net/redact-sensitive-url.test.ts (modified, +6/-0)
  • src/shared/net/redact-sensitive-url.ts (modified, +3/-0)

PR #67738: fix: MS Teams OAuth on Windows and browser.cdpUrl security redaction

Description (problem / solution / changelog)

Summary

Fixes two issues:

  1. #67659 - MS Teams delegated OAuth launcher uses xdg-open on Windows instead of explorer.exe
  2. #67656 - Config API redaction does not cover browser.cdpUrl paths

Root Cause

  1. For #67659: The function only checked for Darwin (macOS) and defaulted to for all other platforms, including Windows.
  2. For #67656: The function did not include paths, allowing credentials in browser CDP URLs to leak in config responses.

Fix

  1. Added explicit platform check for Windows () to use instead of
  2. Added suffix check to to ensure browser CDP URLs are treated as sensitive

Test Plan

  • Unit tests pass for redact-sensitive-url
  • Schema hint tests pass
  • Code follows existing patterns

Closes openclaw#67659 Closes openclaw#67656

Changed files

  • extensions/msteams/src/setup-surface.test.ts (modified, +7/-1)
  • extensions/msteams/src/setup-surface.ts (modified, +7/-2)
  • src/shared/net/redact-sensitive-url.test.ts (modified, +2/-0)
  • src/shared/net/redact-sensitive-url.ts (modified, +3/-0)
RAW_BUFFERClick to expand / collapse

Sub-issue of #64046

Maintainer requirements

  • Scope: ensure all config response surfaces apply the same secret-redaction policy.
  • Deliverable: unified redaction behavior for parsed/source/runtime style snapshots.
  • Acceptance criteria: no plaintext secrets in read-scoped config responses; regression tests for provider keys, gateway tokens, URL tokens, and SecretRef variants.

Problem

browser.cdpUrl and browser.profiles.*.cdpUrl bypass all three redaction gates:

Redaction gateWhy cdpUrl is missed
Schema .register(sensitive)Not registered (zod-schema.ts lines 360, 387)
Path-name pattern (/token$/i, /api.?key$/i, …)cdpUrl doesn't match any suffix
URL-path match (.baseUrl, .httpUrl, mcp.servers.*.url).cdpUrl not listed in isSensitiveUrlConfigPath()

Result: config.get returns plaintext credentials in all five snapshot fields (raw, parsed, sourceConfig, runtimeConfig, resolved).

cdpUrl credential formats (from docs/tools/browser.md)

FormatExample
Query tokenhttps://chrome.browserless.io?token=<secret>
HTTP Basic authhttps://user:[email protected]

"Treat remote CDP URLs/tokens as secrets" — docs/tools/browser.md

Field coverage audit

Config pathEmbeds credentials?Covered?
models.providers.*.baseUrlYes✅
mcp.servers.*.urlYes✅
gateway.auth.token / .passwordYes✅
gateway.remote.token / .passwordYes✅
cron.webhookTokenYes✅
skills.*.apiKeyYes✅
browser.cdpUrlYes❌
browser.profiles.*.cdpUrlYes❌

Related issues

  • #59793 — config.get returns unredacted API keys in sourceConfig / runtimeConfig
  • #53433 — remote CDP URLs bypass config redaction and leak credentials

extent analysis

TL;DR

Register cdpUrl as a sensitive field in the schema and update the URL-path match to include .cdpUrl to ensure secret redaction.

Guidance

  • Review zod-schema.ts lines 360 and 387 to register cdpUrl as a sensitive field using the .register(sensitive) method.
  • Update the isSensitiveUrlConfigPath() function to include .cdpUrl in the list of sensitive URL paths.
  • Verify that the config.get method returns redacted credentials for browser.cdpUrl and browser.profiles.*.cdpUrl in all snapshot fields.
  • Test the changes with different cdpUrl formats, such as query tokens and HTTP Basic auth, to ensure proper redaction.

Example

// zod-schema.ts
const cdpUrlSchema = z.string().register(sensitive);

// isSensitiveUrlConfigPath.js
function isSensitiveUrlConfigPath(path) {
  // ...
  return path.includes('.cdpUrl') || // add this line
    path.includes('.baseUrl') ||
    path.includes('.httpUrl') ||
    // ...
}

Notes

The provided solution assumes that the zod-schema.ts and isSensitiveUrlConfigPath() function are the correct locations to make the necessary changes. Additional testing and verification may be required to ensure that the changes do not introduce any regressions.

Recommendation

Apply the workaround by registering cdpUrl as a sensitive field and updating the isSensitiveUrlConfigPath() function, as this will ensure that credentials are properly redacted in the config.get responses.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#environment variable#network issue#logging issue#authentication issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix [Security]: Config API redaction does not cover browser.cdpUrl paths [2 pull requests, 1 participants]