fix: validate configure gateway ports strictly

steipete · steipete · commit e8f29087ae5b · 2026-05-28T14:43:19.000-04:00
diff --git a/src/cli/shared/parse-port.test.ts b/src/cli/shared/parse-port.test.ts
@@ -37,5 +37,7 @@ describe("parsePort (#83899, #83900)", () => {
     expect(parsePort(Number.POSITIVE_INFINITY)).toBeNull();
     expect(parsePort("abc")).toBeNull();
     expect(parsePort("8080ms")).toBeNull();
+    expect(parsePort("0x10")).toBeNull();
+    expect(parsePort("1e3")).toBeNull();
   });
 });
diff --git a/src/commands/configure.gateway.ts b/src/commands/configure.gateway.ts
@@ -1,4 +1,5 @@
 import { formatPortRangeHint } from "../cli/error-format.js";
+import { parsePort } from "../cli/shared/parse-port.js";
 import { resolveGatewayPort } from "../config/config.js";
 import type { OpenClawConfig } from "../config/types.openclaw.js";
 import { isValidEnvSecretRefId, type SecretInput } from "../config/types.secrets.js";
@@ -8,7 +9,6 @@ import {
   TAILSCALE_EXPOSURE_OPTIONS,
   TAILSCALE_MISSING_BIN_NOTE_LINES,
 } from "../gateway/gateway-config-prompts.shared.js";
-import { parseStrictPositiveInteger } from "../infra/parse-finite-number.js";
 import { findTailscaleBinary } from "../infra/tailscale.js";
 import type { RuntimeEnv } from "../runtime.js";
 import { resolveDefaultSecretProviderAlias } from "../secrets/ref-contract.js";
@@ -29,8 +29,7 @@ type GatewayAuthChoice = "token" | "password" | "trusted-proxy";
 type GatewayTokenInputMode = "plaintext" | "ref";
 
 function validateGatewayPortInput(value: unknown): string | undefined {
-  const port = Number(typeof value === "string" ? value.trim() : value);
-  if (!Number.isInteger(port) || port < 1 || port > 65_535) {
+  if (parsePort(value) === null) {
     return formatPortRangeHint();
   }
   return undefined;
@@ -52,7 +51,7 @@ export async function promptGatewayConfig(
     }),
     runtime,
   );
-  const port = parseStrictPositiveInteger(portRaw) ?? resolveGatewayPort(cfg);
+  const port = parsePort(portRaw) ?? resolveGatewayPort(cfg);
 
   let bind = guardCancel(
     await select({
diff --git a/src/commands/configure.wizard.ts b/src/commands/configure.wizard.ts
@@ -5,12 +5,12 @@ import { describeCodexNativeWebSearch } from "../agents/codex-native-web-search.
 import { formatCliCommand } from "../cli/command-format.js";
 import { formatPortRangeHint } from "../cli/error-format.js";
 import { commitConfigWithPendingPluginInstalls } from "../cli/plugins-install-record-commit.js";
+import { parsePort } from "../cli/shared/parse-port.js";
 import { readConfigFileSnapshot, resolveGatewayPort } from "../config/config.js";
 import { logConfigUpdated } from "../config/logging.js";
 import { ConfigMutationConflictError } from "../config/mutate.js";
 import type { OpenClawConfig } from "../config/types.openclaw.js";
 import { ensureControlUiAssetsBuilt } from "../infra/control-ui-assets.js";
-import { parseStrictPositiveInteger } from "../infra/parse-finite-number.js";
 import { resolvePluginContributionOwners } from "../plugins/plugin-registry.js";
 import type { RuntimeEnv } from "../runtime.js";
 import { defaultRuntime } from "../runtime.js";
@@ -65,8 +65,7 @@ const setupPluginConfigModuleLoader = createLazyImportLoader<SetupPluginConfigMo
 );
 
 function validateGatewayPortInput(value: unknown): string | undefined {
-  const port = Number(typeof value === "string" ? value.trim() : value);
-  if (!Number.isInteger(port) || port < 1 || port > 65_535) {
+  if (parsePort(value) === null) {
     return formatPortRangeHint();
   }
   return undefined;
@@ -641,7 +640,7 @@ export async function runConfigureWizard(
         }),
         runtime,
       );
-      gatewayPort = parseStrictPositiveInteger(portInput) ?? gatewayPort;
+      gatewayPort = parsePort(portInput) ?? gatewayPort;
     };
 
     if (selectedSections) {
