openclaw - 💡(How to fix) Fix Security: Predictable temp file paths enable symlink attacks in multiple modules [1 comments, 2 participants]

Fix Plan

To address the issue, we will modify the affected modules to use a secure method for generating temporary file names and ensure exclusive creation.

Step 1: Modify Secrets Writer

Replace the existing line in dist/shared-B5oxOBg0.js:33 with:

const crypto = require('crypto');
const tempPath = `${pathname}.tmp-${crypto.randomBytes(16).toString("hex")}`;

And open the file with O_EXCL protection:

const fs = require('fs');
fs.open(tempPath, 'w', { flag: 'wx' }, (err, fd) => {
  // handle file operations
});

Step 2: Modify Delivery Queue

Replace the existing line in dist/delivery-queue-DHURMSqX.js:31 with:

const crypto = require('crypto');
const tmp = `${filePath}.${crypto.randomBytes(16).toString("hex")}.tmp`;

And open the file with O_EXCL protection:

const fs = require('fs');
fs.open(tmp, 'w', { flag: 'wx' }, (err, fd) => {
  // handle file operations
});

Step 3: Modify Workspace State

Replace the existing line in dist/workspace-D4K6QX9X.js:214 with:

const crypto = require('crypto');
const tmpPath = `${statePath}.tmp-${crypto.randomBytes(16).toString("hex")}`;

And open the file with O_EXCL protection:

const fs = require('fs');
fs.open(tmpPath, 'w', { flag: 'wx' }, (err, fd) => {
  // handle file operations
});

Alternatively, use the existing core temp path utility that already uses crypto.randomUUID().

Verification

To verify the fix, test the modified modules by attempting to create symlinks at the predicted paths and verify that the temporary files are created with unique names and exclusive access.

Extra Tips

• Consider using a library like tmp to handle temporary file creation and removal.
• Ensure that all temporary files are properly removed after use to prevent information disclosure.
• Regularly review and update code to ensure that security best practices are followed.