SleuthCo.AI fe609c0c77 security(hooks): block prototype-chain traversal in webhook template getByPath (#22213) ...

* security(hooks): block prototype-chain traversal in webhook template getByPath

The getByPath() function in hooks-mapping.ts traverses attacker-controlled
webhook payload data using arbitrary property path expressions, but does not
filter dangerous property names (__proto__, constructor, prototype).

The config-paths module (config-paths.ts) already blocks these exact keys
for config path traversal via a BLOCKED_KEYS set, but the hooks template
system was not protected with the same guard.

Add a BLOCKED_PATH_KEYS set mirroring config-paths.ts and reject traversal
into __proto__, prototype, or constructor in getByPath(). Add three test
cases covering all three blocked keys.

Signed-off-by: Alan Ross <alan@sleuthco.ai>

* test(gateway): narrow hook action type in prototype-pollution tests

* changelog: credit hooks prototype-path guard in PR 22213

* changelog: move hooks prototype-path fix into security section

---------

Signed-off-by: Alan Ross <alan@sleuthco.ai>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>

2026-02-21 03:01:03 -05:00

..

protocol

Issue 17774 - Usage - Local - Show data from midnight to midnight of selected dates for browser time zone (AI assisted) (openclaw#19357) thanks @huntharo

2026-02-20 20:09:03 -06:00

server

fix: Control UI Insecure Auth Bypass Allows Token-Only Auth Over HTTP (#20684)

2026-02-20 17:34:34 +00:00

server-methods

Session: enforce startup sequence on bare reset greeting

2026-02-20 20:38:56 -08:00

agent-event-assistant-text.ts

refactor(gateway): dedupe assistant delta parsing

2026-02-15 19:08:47 +00:00

agent-prompt.e2e.test.ts

…

agent-prompt.ts

…

assistant-identity.test.ts

…

assistant-identity.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

auth-rate-limit.test.ts

…

auth-rate-limit.ts

…

auth.test.ts

Security: default gateway auth bootstrap and explicit mode none (#20686)

2026-02-19 02:35:50 -05:00

auth.ts

Security: default gateway auth bootstrap and explicit mode none (#20686)

2026-02-19 02:35:50 -05:00

boot.test.ts

test: dedupe and optimize test suites

2026-02-19 15:19:38 +00:00

boot.ts

fix: run BOOT.md for each configured agent at startup (#20569)

2026-02-19 00:58:56 -05:00

call.test.ts

Gateway: force loopback self-connections for local binds

2026-02-20 13:08:26 -08:00

call.ts

Gateway: force loopback self-connections for local binds

2026-02-20 13:08:26 -08:00

canvas-capability.ts

fix(gateway): harden canvas auth with session capabilities

2026-02-19 15:51:22 +01:00

channel-health-monitor.test.ts

perf(test): reduce channel health monitor check slack

2026-02-18 22:39:57 +00:00

channel-health-monitor.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

chat-abort.test.ts

Gateway/Control UI: preserve partial output on abort (#15026)

2026-02-15 16:55:28 -08:00

chat-abort.ts

Gateway/Control UI: preserve partial output on abort (#15026)

2026-02-15 16:55:28 -08:00

chat-attachments.test.ts

chore: Fix types in tests 25/N.

2026-02-17 14:31:02 +09:00

chat-attachments.ts

refactor(channels): dedupe transport and gateway test scaffolds

2026-02-16 14:59:31 +00:00

chat-sanitize.test.ts

fix(tui): strip inbound metadata blocks from user messages (clean rewrite) (#22345)

2026-02-20 23:52:43 -05:00

chat-sanitize.ts

fix(tui): strip inbound metadata blocks from user messages (clean rewrite) (#22345)

2026-02-20 23:52:43 -05:00

client.e2e.test.ts

…

client.test.ts

fix(gateway): clear pairing state on device token mismatch (#22071)

2026-02-20 18:21:13 +00:00

client.ts

fix(gateway): clear pairing state on device token mismatch (#22071)

2026-02-20 18:21:13 +00:00

config-reload.test.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

config-reload.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

control-plane-audit.ts

fix: harden gateway control-plane restart protections

2026-02-19 14:30:15 +01:00

control-plane-rate-limit.ts

fix: harden gateway control-plane restart protections

2026-02-19 14:30:15 +01:00

control-ui-contract.ts

refactor(gateway): share Control UI bootstrap contract and CSP

2026-02-16 03:50:39 +01:00

control-ui-csp.test.ts

refactor(gateway): share Control UI bootstrap contract and CSP

2026-02-16 03:50:39 +01:00

control-ui-csp.ts

refactor(gateway): share Control UI bootstrap contract and CSP

2026-02-16 03:50:39 +01:00

control-ui-shared.ts

…

control-ui.http.test.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

control-ui.ts

fix(gateway): return 404 for missing static assets instead of SPA fallback (#12060)

2026-02-20 17:41:57 +00:00

device-auth.ts

…

events.ts

refactor: unify restart gating and update availability sync

2026-02-19 10:00:41 +01:00

exec-approval-manager.ts

…

gateway-cli-backend.live.test.ts

test(gateway): dedupe agent payload and stream fixtures

2026-02-19 09:22:16 +00:00

gateway-config-prompts.shared.ts

refactor(gateway): share tailscale prompt constants

2026-02-15 18:06:48 +00:00

gateway-misc.test.ts

fix(gateway): return 404 for missing static assets instead of SPA fallback (#12060)

2026-02-20 17:41:57 +00:00

gateway-models.profiles.live.test.ts

test(gateway): dedupe agent payload and stream fixtures

2026-02-19 09:22:16 +00:00

gateway.e2e.test.ts

test(gateway): dedupe agent payload and stream fixtures

2026-02-19 09:22:16 +00:00

hooks-mapping.test.ts

security(hooks): block prototype-chain traversal in webhook template getByPath (#22213)

2026-02-21 03:01:03 -05:00

hooks-mapping.ts

security(hooks): block prototype-chain traversal in webhook template getByPath (#22213)

2026-02-21 03:01:03 -05:00

hooks.test.ts

refactor(channels): dedupe transport and gateway test scaffolds

2026-02-16 14:59:31 +00:00

hooks.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

http-auth-helpers.ts

…

http-common.ts

security: add baseline security headers to gateway HTTP responses (#10526)

2026-02-19 03:28:24 -08:00

http-endpoint-helpers.test.ts

…

http-endpoint-helpers.ts

…

http-utils.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

live-image-probe.ts

…

method-scopes.test.ts

fix(security): centralize owner-only tool gating and scope maps

2026-02-19 15:29:23 +01:00

method-scopes.ts

fix(security): centralize owner-only tool gating and scope maps

2026-02-19 15:29:23 +01:00

net.test.ts

test: correct trusted proxy X-Forwarded-For expectation

2026-02-21 00:48:22 -05:00

net.ts

gateway: trust-proxy-aware X-Forwarded-For resolution (#22466)

2026-02-21 01:23:21 -05:00

node-command-policy.ts

…

node-invoke-sanitize.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

node-invoke-system-run-approval.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

node-registry.ts

…

open-responses.schema.ts

…

openai-http.e2e.test.ts

test(gateway): dedupe agent payload and stream fixtures

2026-02-19 09:22:16 +00:00

openai-http.ts

refactor(gateway): share openai response text extraction

2026-02-18 18:54:22 +00:00

openresponses-http.e2e.test.ts

test(gateway): dedupe agent payload and stream fixtures

2026-02-19 09:22:16 +00:00

openresponses-http.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

openresponses-parity.e2e.test.ts

…

origin-check.test.ts

…

origin-check.ts

refactor(gateway): share host header parsing

2026-02-15 16:15:53 +00:00

probe-auth.ts

…

probe.test.ts

Gateway: align pairing scope checks for read access

2026-02-20 05:12:05 +00:00

probe.ts

Gateway: align pairing scope checks for read access

2026-02-20 05:12:05 +00:00

server-broadcast.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

server-browser.ts

…

server-channels.test.ts

perf(test): tighten fake timer windows in channel restart tests

2026-02-18 22:11:56 +00:00

server-channels.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

server-chat.agent-events.test.ts

Gateway/TUI: filter heartbeat ACK noise in chat events

2026-02-20 20:23:28 -08:00

server-chat.ts

Gateway/TUI: filter heartbeat ACK noise in chat events

2026-02-20 20:23:28 -08:00

server-close.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

server-constants.ts

fix(canvas): port remaining iOS branch stability fixes (#18228)

2026-02-16 16:42:28 +00:00

server-cron.test.ts

fix(gateway): guard cron webhook delivery against SSRF

2026-02-18 04:48:08 +01:00

server-cron.ts

fix(gateway): guard cron webhook delivery against SSRF

2026-02-18 04:48:08 +01:00

server-discovery-runtime.ts

…

server-discovery.test.ts

…

server-discovery.ts

…

server-http.hooks-request-timeout.test.ts

…

server-http.ts

fix(gateway): harden canvas auth with session capabilities

2026-02-19 15:51:22 +01:00

server-lanes.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

server-maintenance.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

server-methods-list.ts

refactor: unify restart gating and update availability sync

2026-02-19 10:00:41 +01:00

server-methods.control-plane-rate-limit.test.ts

style: format gateway server methods

2026-02-19 13:32:58 +00:00

server-methods.ts

fix(gateway): allow health method for all authenticated roles (#19699)

2026-02-20 17:48:44 +00:00

server-mobile-nodes.ts

…

server-model-catalog.ts

…

server-node-events-types.ts

…

server-node-events.test.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

server-node-events.ts

Gateway: add APNs push test pipeline (#20307)

2026-02-18 19:32:42 +00:00

server-node-subscriptions.ts

…

server-plugins.test.ts

chore: Fix types in tests 38/N.

2026-02-17 15:50:07 +09:00

server-plugins.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

server-reload-handlers.ts

refactor: unify restart gating and update availability sync

2026-02-19 10:00:41 +01:00

server-restart-deferral.test.ts

perf(test): cut gateway unit suite overhead

2026-02-16 00:18:26 +00:00

server-restart-sentinel.ts

fix(types): align restart sentinel and typing test mocks

2026-02-18 18:25:25 +00:00

server-runtime-config.test.ts

fix(gateway): require loopback proxy IP for trusted-proxy + bind=loopback (#22082)

2026-02-20 18:03:53 +00:00

server-runtime-config.ts

fix(gateway): require loopback proxy IP for trusted-proxy + bind=loopback (#22082)

2026-02-20 18:03:53 +00:00

server-runtime-state.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

server-session-key.ts

…

server-shared.ts

…

server-startup-log.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

server-startup-memory.test.ts

Memory/QMD: harden multi-collection search and embed scheduling

2026-02-20 19:41:51 -08:00

server-startup-memory.ts

Memory/QMD: harden multi-collection search and embed scheduling

2026-02-20 19:41:51 -08:00

server-startup.ts

refactor(gateway): share gmail watcher startup flow

2026-02-18 17:48:02 +00:00

server-tailscale.ts

…

server-utils.ts

…

server-wizard-sessions.ts

…

server-ws-runtime.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

server.agent.gateway-server-agent-a.e2e.test.ts

refactor: eliminate jscpd clones and boost tests

2026-02-19 15:08:54 +00:00

server.agent.gateway-server-agent-b.e2e.test.ts

Session: enforce startup sequence on bare reset greeting

2026-02-20 20:38:56 -08:00

server.agent.gateway-server-agent.mocks.ts

…

server.auth.e2e.test.ts

fix(gateway): allow health method for all authenticated roles (#19699)

2026-02-20 17:48:44 +00:00

server.canvas-auth.e2e.test.ts

refactor: eliminate jscpd clones and boost tests

2026-02-19 15:08:54 +00:00

server.channels.e2e.test.ts

refactor: eliminate jscpd clones and boost tests

2026-02-19 15:08:54 +00:00

server.chat.gateway-server-chat-b.e2e.test.ts

fix(tui): strip inbound metadata blocks from user messages (clean rewrite) (#22345)

2026-02-20 23:52:43 -05:00

server.chat.gateway-server-chat.e2e.test.ts

chore: Fix types in tests 18/N.

2026-02-17 12:00:29 +09:00

server.config-apply.e2e.test.ts

test(gateway): dedupe config.apply request scaffolding

2026-02-19 08:25:12 +00:00

server.config-patch.e2e.test.ts

test(gateway): cover mixed-id config.patch rollback

2026-02-16 08:24:55 -05:00

server.cron.e2e.test.ts

fix cron announce routing and timeout handling

2026-02-17 11:40:04 -08:00

server.e2e-registry-helpers.ts

refactor(channels): dedupe transport and gateway test scaffolds

2026-02-16 14:59:31 +00:00

server.e2e-ws-harness.ts

refactor(test): reuse env snapshot in gateway ws harness

2026-02-15 23:56:57 +00:00

server.health.e2e.test.ts

chore: Fix types in tests 3/N.

2026-02-17 10:57:31 +09:00

server.hooks.e2e.test.ts

chore: Fix types in tests 11/N.

2026-02-17 11:22:49 +09:00

server.impl.ts

refactor: unify restart gating and update availability sync

2026-02-19 10:00:41 +01:00

server.ios-client-id.e2e.test.ts

refactor(test): dedupe ios/android gateway client id tests

2026-02-15 23:07:50 +00:00

server.models-voicewake-misc.e2e.test.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

server.node-invoke-approval-bypass.e2e.test.ts

perf(test): use setImmediate for node invoke bypass yields

2026-02-18 22:09:48 +00:00

server.plugin-http-auth.test.ts

refactor(channels): dedupe transport and gateway test scaffolds

2026-02-16 14:59:31 +00:00

server.reload.e2e.test.ts

refactor(test): share gateway server start helper

2026-02-15 23:02:27 +00:00

server.roles-allowlist-update.e2e.test.ts

fix(gateway): allow health method for all authenticated roles (#19699)

2026-02-20 17:48:44 +00:00

server.sessions-send.e2e.test.ts

chore: Fix types in tests 25/N.

2026-02-17 14:31:02 +09:00

server.sessions.gateway-server-sessions-a.e2e.test.ts

security(gateway): block webchat session mutators (#20800)

2026-02-19 01:54:02 -08:00

server.skills-status.e2e.test.ts

refactor(channels): dedupe transport and gateway test scaffolds

2026-02-16 14:59:31 +00:00

server.talk-config.e2e.test.ts

refactor(channels): dedupe transport and gateway test scaffolds

2026-02-16 14:59:31 +00:00

server.ts

…

session-preview.test-helpers.ts

refactor(gateway-test): share preview transcript fixture

2026-02-18 17:01:22 +00:00

session-utils.fs.test.ts

refactor(gateway-test): share preview transcript fixture

2026-02-18 17:01:22 +00:00

session-utils.fs.ts

refactor(gateway): share transcript path/fd helpers

2026-02-18 18:35:04 +00:00

session-utils.test.ts

fix(cli): display correct model for sub-agents in sessions list (#18660)

2026-02-17 23:59:20 -05:00

session-utils.ts

fix(cli): display correct model for sub-agents in sessions list (#18660)

2026-02-17 23:59:20 -05:00

session-utils.types.ts

…

sessions-patch.test.ts

test: dedupe gateway auth and sessions patch coverage

2026-02-18 05:30:59 +00:00

sessions-patch.ts

fix(cli): display correct model for sub-agents in sessions list (#18660)

2026-02-17 23:59:20 -05:00

sessions-resolve.ts

…

startup-auth.test.ts

fix: enforce hooks token separation from gateway auth (#20813)

2026-02-19 02:48:08 -08:00

startup-auth.ts

fix: enforce hooks token separation from gateway auth (#20813)

2026-02-19 02:48:08 -08:00

test-helpers.agent-results.ts

test(gateway): dedupe agent payload and stream fixtures

2026-02-19 09:22:16 +00:00

test-helpers.e2e.ts

refactor(channels): dedupe transport and gateway test scaffolds

2026-02-16 14:59:31 +00:00

test-helpers.mocks.ts

fix: remove hardcoded disableBlockStreaming to honor agent config for TUI (#19693)

2026-02-18 16:25:59 -05:00

test-helpers.openai-mock.ts

…

test-helpers.server.ts

refactor: eliminate jscpd clones and boost tests

2026-02-19 15:08:54 +00:00

test-helpers.ts

…

test-http-response.ts

refactor(channels): dedupe transport and gateway test scaffolds

2026-02-16 14:59:31 +00:00

test-openai-responses-model.ts

refactor(channels): dedupe transport and gateway test scaffolds

2026-02-16 14:59:31 +00:00

test-temp-config.ts

refactor(channels): dedupe transport and gateway test scaffolds

2026-02-16 14:59:31 +00:00

test-with-server.ts

refactor(channels): dedupe transport and gateway test scaffolds

2026-02-16 14:59:31 +00:00

tools-invoke-http.test.ts

refactor(test): dedupe channel and monitor action suites

2026-02-18 04:49:22 +00:00

tools-invoke-http.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

ws-log.test.ts

…

ws-log.ts

refactor(channels): dedupe transport and gateway test scaffolds

2026-02-16 14:59:31 +00:00

ws-logging.ts

…