RightNow-AI/openfang v0.3.30

v0.3.30 — Security Hardening

on GitHub

Security Hardening

Comprehensive security audit and fixes in response to responsible disclosure:

Shell Execution Sandbox (CRITICAL)

• Allowlist mode now uses direct argv execution via shlex — no shell interpreter invoked
• Commands are split into program + arguments and passed to execve() directly
• Eliminates entire class of injection attacks: encoding tricks, $IFS, glob expansion, variable expansion
• Full mode (user opt-in) still uses sh -c with metacharacter filtering as defense-in-depth
• Metacharacter filter blocks: ; | > < {} \0 & && ||

API Auth Hardening (CRITICAL)

• All public endpoints are now GET-only — POST/PUT/DELETE always require authentication
• Prevents unauthenticated cron job creation, skill installation, integration reload, agent spawning
• WebSocket auth now uses constant-time comparison (fixes timing side-channel)

OFP Wire Protocol (HIGH)

• send_to_peer() derives session key and uses per-message HMAC authenticated I/O
• broadcast_notification() requires shared secret and uses authenticated writes
• connection_loop() uses authenticated reads/writes for all post-handshake messages
• No plaintext message paths exist after any successful handshake

Audit Trail Persistence (MEDIUM)

• V8 migration adds audit_entries SQLite table with Merkle chain fields
• Entries persisted immediately on every write
• Boot-time integrity verification detects tampering

Bug Fixes

• #437 Gemini API key sent as query parameter + enhanced error parsing
• #429 CJK IME composition no longer triggers send on Enter key
• #434 OpenClaw migration handles nested JSON objects in tool config
• #403 Discord ignore_bots config option (default true)
• #407 Browser Hand requires chromium instead of obsolete python3/playwright

Stats

• 24 files changed, 957 insertions, 224 deletions
• 1,886 tests passing, 0 clippy warnings