From c05436944d11a4e1935c4d01564fe2ee5c34afe7 Mon Sep 17 00:00:00 2001 From: rookiestar28 Date: Fri, 31 Jul 2026 06:42:01 +0800 Subject: [PATCH] fix(security): contain posture evaluation errors --- services/effective_security_posture.py | 12 ++++++++++-- tests/test_effective_security_posture.py | 16 ++++++++++++++++ 2 files changed, 26 insertions(+), 2 deletions(-) diff --git a/services/effective_security_posture.py b/services/effective_security_posture.py index 76fa072..1d7f091 100644 --- a/services/effective_security_posture.py +++ b/services/effective_security_posture.py @@ -213,7 +213,12 @@ def resolve_effective_security_posture( else deployment_profile ) - report = _deployment_report(deployment_profile, env) + try: + report = _deployment_report(deployment_profile, env) + except Exception: + # CRITICAL: delegated evaluators must not expose hostile mapping values or + # exception text across the immutable posture boundary. + raise ValueError("security posture evaluation failed") from None findings = tuple(_safe_finding(check) for check in report.checks) pass_codes = tuple(item.code for item in findings if item.severity == "pass") warn_codes = tuple(item.code for item in findings if item.severity == "warn") @@ -245,7 +250,10 @@ def resolve_effective_security_posture( _normalized(env, "OPENCLAW_SPLIT_COMPAT_OVERRIDE") in _CONTROL_PLANE_TRUTHY ) - connector = _connector_posture(env) + try: + connector = _connector_posture(env) + except Exception: + raise ValueError("security posture evaluation failed") from None active_platforms = tuple( sorted({str(item) for item in connector["active_platforms"]}) ) diff --git a/tests/test_effective_security_posture.py b/tests/test_effective_security_posture.py index 649bc8d..72168c4 100644 --- a/tests/test_effective_security_posture.py +++ b/tests/test_effective_security_posture.py @@ -386,6 +386,22 @@ class EffectiveSecurityPostureTestCase(unittest.TestCase): ) self.assertNotIn("PRIVATE_PROFILE_CANARY", str(profile_error.exception)) + class LateExplodingMapping(dict): + def get(self, key, default=None): + if key == "OPENCLAW_CONNECTOR_SLACK_BOT_TOKEN": + raise RuntimeError("PRIVATE_DELEGATED_MAPPING_CANARY") + return super().get(key, default) + + with self.assertRaisesRegex( + ValueError, "^security posture evaluation failed$" + ) as delegated_error: + resolve_effective_security_posture( + LateExplodingMapping(), network_exposed=False + ) + self.assertNotIn( + "PRIVATE_DELEGATED_MAPPING_CANARY", str(delegated_error.exception) + ) + def test_request_dynamic_security_state_is_not_in_snapshot_schema(self): forbidden_names = { "presented",