fix(agent): validate --id as a DNS label to stop /etc/hosts injection#774
Merged
Merged
Conversation
Root cause: agent --id was only TrimSpace'd before being embedded into a
hostname (agentruntime.Hostname) and written to /etc/hosts via
dns.EnsureHostsEntries (sudo tee), with no newline/char filtering. A
newline in --id injects arbitrary /etc/hosts lines.
Fix (defense in depth):
1. hermes.Onboard and openclaw.Onboard now validate the resolved id with
the existing validate.Name DNS-label check (^[a-z0-9][a-z0-9-]{0,62}$)
before it is used to build deploymentDir/namespace/hostname, rejecting
ids with newlines, spaces, slashes, leading dashes, or empty/oversized
values.
2. dns.EnsureHostsEntries now skips any hostname that fails a new
isValidHostname DNS-charset check before it is written into the
/etc/hosts managed block, so a malformed hostname can never reach the
file even from a caller that bypasses Onboard's validation.
Confirmed Canary402 full-surface audit finding.
Claude-Session: https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Full-surface audit finding (HIGH): agent
--idinjects lines into root-owned/etc/hostsFound by the 2026-07-16 whole-product-surface audit (PR #770), adversarially confirmed.
obol agent new --id <value>passed the raw--id(onlyTrimSpaced) into a hostname string that is written to/etc/hostsviasudo tee(internal/dns/resolver.go) with no character filtering. An--idcontaining a newline injects arbitrary/etc/hostsentries (e.g. redirect a domain to an attacker IP). The same unvalidated--idalso flowed into filesystem paths and a recursive-delete target (the sibling MEDIUM finding) — both closed here.Fix (defense in depth)
--idis validated as a strict DNS label (^[a-z0-9]([-a-z0-9]*[a-z0-9])?$, bounded length) at theOnboardboundary (sharedvalidatehelper, used by both hermes and openclaw paths) — it becomes a hostname, so this is correct regardless of the injection./etc/hostswriter skips any hostname containing a non-DNS character, so no malformed value can reach the file even from another caller.Test: validator rejects newline/space/slash/leading-dash/empty ids, accepts normal ones; resolver skips a malformed hostname. Tests green.
https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk