openclaw - 💡(How to fix) Fix Security: Unauthorized OAuth credential extraction from Gemini CLI installation [1 comments, 2 participants]

Fix Plan

To address the issue, we will:

• Remove the automatic credential extraction from external tools
• Require explicit configuration of OAuth credentials via environment variables or config files
• Display a warning and require user confirmation when using OAuth credentials

Code Changes

We will update the extractGeminiCliCredentials() function to remove the hardcoded regex patterns and instead throw an error if the credentials are not provided via environment variables or config files.

// Remove the regex patterns and throw an error if credentials are not provided
function extractGeminiCliCredentials() {
  if (!process.env.GOOGLE_CLIENT_ID || !process.env.GOOGLE_CLIENT_SECRET) {
    throw new Error('OAuth credentials not provided. Please set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET environment variables or configure via a config file.');
  }
  // Return the credentials from environment variables or config files
  return {
    clientId: process.env.GOOGLE_CLIENT_ID,
    clientSecret: process.env.GOOGLE_CLIENT_SECRET,
  };
}

Configuration Changes

We will add a warning message to inform the user that OAuth credentials are required and must be provided explicitly.

// Display a warning message to the user
console.warn('OAuth credentials are required and must be provided explicitly via environment variables or config files.');

Verification

To verify the fix, we will:

• Run the application without setting the GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET environment variables
• Verify that the application throws an error and displays a warning message
• Set the environment variables or configure via a config file and verify that the application uses the provided credentials correctly

Extra Tips

• Always prioritize explicit user consent when handling sensitive information like OAuth credentials
• Use secure methods to store and manage credentials, such as encrypted config files or secure environment variable storage
• Regularly review and update dependencies to ensure the latest security patches and best practices are applied.