Skip to content

v5.15.6 - CodeQL auth-first transport fix, ClawHub scan follow-up

Choose a tag to compare

View all tags
@Jovancoding Jovancoding released this 17 Oct 19:34
· 5 commits to main since this release
v5.15.6
f0551f6

Security

  • CodeQL #184, #185, #186 (js/user-controlled-bypass, lib/swarm-transport.ts): the envelope-shape check ran before HMAC verification, so request-controlled fields decided whether a request reached verifySigned(). Not exploitable (that branch only rejected requests), but SwarmTransportServer now authenticates first: with a shared secret configured, signature, freshness, and replay checks run right after JSON parsing, before any envelope or allowlist branch, and non-object bodies are rejected.

ClawHub skill (5.15.5 scan follow-up)

  • Removed the contradictory pip install filelock advice; locking is built in (fcntl on Unix, atomic lock-marker file on Windows).
  • Corrected "five" to six scripts; token-expiry wording now matches behavior (validate_token.py rejects expired grants; removal is a manual --cleanup).
  • New filesystem_operations capability and blackboard.py header declare deletions and archival.
  • check_permission.py docstrings state its permission-gating scope and name the abstract resource labels.

Tests

3,740 tests across 41 suites; tsc --noEmit clean; local HOL plugin-scanner 95/100.

Full changelog: v5.15.5...v5.15.6

Assets 2
Loading