feat: integrate claw-code parity bridges and compatibility tools#3
Open
yashwant86 wants to merge 5 commits intomainfrom
Open
feat: integrate claw-code parity bridges and compatibility tools#3yashwant86 wants to merge 5 commits intomainfrom
yashwant86 wants to merge 5 commits intomainfrom
Conversation
added 5 commits
April 16, 2026 01:55
WalkthroughA developer runs Changes
Sequence DiagramsequenceDiagram
participant Dev as Developer
participant Script as ParityHarness
participant FS as FileSystem
participant Baseline as BaselineJSON
participant Diff as DiffEngine
Dev->>Script: pnpm lint:parity:claw-code
Script->>FS: collectClawCodeParityHarnessSnapshot()
loop For each lane (1-9)
FS-->>Script: hasPattern(file, regex) → boolean
end
Script->>Script: Build ParityLaneEntry[]
Script->>Baseline: readExpectedInventory()
Baseline-->>Script: expected entries
Script->>Diff: diffInventory(expected, actual)
Diff-->>Script: added/removed/changed
alt No drift
Script-->>Dev: Exit 0 (pass)
else Drift detected
Script-->>Dev: Exit 1 + report
end
participant Doctor as DoctorCommand
participant Probe as CapabilityProbe
participant Host as HostSystem
Doctor->>Probe: probeSandboxCapabilities()
Probe->>Host: check docker, unshare, /proc
Host-->>Probe: availability results
Probe-->>Doctor: SandboxCapabilityProbeResult
Doctor-->>Dev: Display sandbox readiness
Dig Deeper With Commands
Runs only when explicitly triggered. |
![mergemonkeyhq[bot]](https://avatars.githubusercontent.com/in/2472657?s=60&v=4){kind=small}
| if (requestBody && !headers["content-type"]) { | ||
| headers["content-type"] = "application/json"; | ||
| } | ||
| const response = await fetch(parsed.toString(), { |
There was a problem hiding this comment.
SSRF via remote_trigger tool — fetch with user-controlled URL and no allowlist
createRemoteTriggerCompatTool makes an arbitrary fetch() call with a URL, method, headers, and body all supplied by the caller. The tool is registered in openclaw-tools.ts:287 as a regular (non-owner-only) tool, meaning any agent can invoke it. There's no URL allowlist, no internal-IP blocking, and no SSRF protection — an attacker-controlled agent could probe internal services, cloud metadata endpoints (169.254.169.254), or other internal infrastructure.
Either add remote_trigger to the owner-only tools list, or implement URL validation that blocks internal/private IP ranges and cloud metadata endpoints before making the fetch call.
Actionable Comments Posted: 1🧾 Coverage Summary✔️ Covered (41 files) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mirror of openclaw#67345
Summary by MergeMonkey