gitops/optimclaw
1
0
Fork 0
mirror of https://github.com/outbackdingo/optimclaw.git synced 2026-09-02 01:29:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): prevent metadata spoofing of internal job monitor flag (#1195)

Browse Source 
The `__internal_job_monitor` metadata key that bypassed the entire
agent pipeline (hooks, safety checks, LLM processing) was spoofable
by external channels — WASM channel plugins could inject arbitrary
metadata including this key, causing attacker-controlled content to be
forwarded directly as assistant responses.

Replace the metadata-based check with a dedicated `is_internal` field
on `IncomingMessage` that can only be set via `into_internal()` by
trusted in-process code. Both the field and setter are `pub(crate)` to
prevent external crates from spoofing the flag. Also remove
`notify_metadata` forwarding (the monitor only needs channel/user/thread
routing) and the unused `__job_monitor_job_id` metadata key.

Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
This commit is contained in:
Illia Polosukhin
2026-03-15 21:33:04 +00:00
committed by GitHub
co-authored by Claude Opus 4.6
parent 3f874e73af
commit bde0b77a86
6 changed files with 143 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/e2e_routine_heartbeat.rs
+4 -36
View File
@@ -218,18 +218,7 @@ mod tests {
engine.refresh_event_cache().await;
// Positive match: message containing "deploy to production".
let matching_msg = IncomingMessage {
id: Uuid::new_v4(),
channel: "test".to_string(),
user_id: "default".to_string(),
user_name: None,
content: "deploy to production now".to_string(),
thread_id: None,
received_at: Utc::now(),
metadata: serde_json::json!({}),
timezone: None,
attachments: Vec::new(),
};
let matching_msg = IncomingMessage::new("test", "default", "deploy to production now");
let fired = engine.check_event_triggers(&matching_msg).await;
assert!(
fired >= 1,
@@ -240,18 +229,8 @@ mod tests {
tokio::time::sleep(Duration::from_millis(500)).await;
// Negative match: message that doesn't match.
let non_matching_msg = IncomingMessage {
id: Uuid::new_v4(),
channel: "test".to_string(),
user_id: "default".to_string(),
user_name: None,
content: "check the staging environment".to_string(),
thread_id: None,
received_at: Utc::now(),
metadata: serde_json::json!({}),
timezone: None,
attachments: Vec::new(),
};
let non_matching_msg =
IncomingMessage::new("test", "default", "check the staging environment");
let fired_neg = engine.check_event_triggers(&non_matching_msg).await;
assert_eq!(fired_neg, 0, "Expected 0 routines fired on non-match");
}
@@ -455,18 +434,7 @@ mod tests {
engine.refresh_event_cache().await;
// First fire should work.
let msg = IncomingMessage {
id: Uuid::new_v4(),
channel: "test".to_string(),
user_id: "default".to_string(),
user_name: None,
content: "test-cooldown trigger".to_string(),
thread_id: None,
received_at: Utc::now(),
metadata: serde_json::json!({}),
timezone: None,
attachments: Vec::new(),
};
let msg = IncomingMessage::new("test", "default", "test-cooldown trigger");
let fired1 = engine.check_event_triggers(&msg).await;
assert!(fired1 >= 1, "First fire should work");