negodiy/openclaw
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix(gateway): block node.invoke exec approvals

Browse Source
This commit is contained in:
Peter Steinberger
2026-02-14 19:21:31 +01:00
parent d0f64c955e
commit 01b3226ecb
4 changed files with 46 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/gateway/node-command-policy.ts
View File

@@ -39,14 +39,7 @@ const SMS_DANGEROUS_COMMANDS = ["sms.send"];
// iOS nodes don't implement system.run/which, but they do support notifications.
const IOS_SYSTEM_COMMANDS = ["system.notify"];
const SYSTEM_COMMANDS = [
"system.run",
"system.which",
"system.notify",
"system.execApprovals.get",
"system.execApprovals.set",
"browser.proxy",
];
const SYSTEM_COMMANDS = ["system.run", "system.which", "system.notify", "browser.proxy"];
// "High risk" node commands. These can be enabled by explicitly adding them to
// `gateway.nodes.allowCommands` (and ensuring they're not blocked by denyCommands).