security(hooks): block prototype-chain traversal in webhook template getByPath by SleuthCo · Pull Request #22213 · openclaw/openclaw

SleuthCo · 2026-02-20T22:05:44Z

Summary

The getByPath() function in hooks-mapping.ts traverses attacker-controlled webhook payload data using arbitrary property path expressions but does not filter dangerous property names (__proto__, constructor, prototype).

The config-paths module (config-paths.ts:5) already blocks these exact keys for config path traversal via a BLOCKED_KEYS set, but the hooks template system was not protected with the same guard.

Vulnerability

When a webhook POST body is parsed via JSON.parse (no reviver), keys like __proto__ become own-properties on the resulting object. The getByPath function will then traverse into these attacker-injected properties if any hook mapping template references them.

Data flow:

POST /hooks/<path> → readJsonBody (JSON.parse, no reviver)
  → applyHookMappings → buildActionFromMapping
    → renderTemplate → resolveTemplateExpr → getByPath
      → current[part]  // no blocklist check

PoC

Config mapping:

hooks:
  mappings:
    - id: "custom"
      match: { path: "ingest" }
      action: "agent"
      messageTemplate: "meta: {{__proto__}}"

Request:

curl -X POST http://localhost:18789/hooks/ingest \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"__proto__": {"secret": "leaked_data"}}'

Before fix: Agent receives meta: {"secret":"leaked_data"} — attacker-injected data rendered into agent message via prototype chain property.

After fix: Agent receives meta: — blocked key returns undefined, rendered as empty string.

Fix

Add a BLOCKED_PATH_KEYS set (mirroring config-paths.ts) and check each path segment before traversal. Three test cases added covering __proto__, constructor, and prototype.

Severity

Medium (defense-in-depth). The path expressions are config-controlled (not attacker-controlled), so exploitation requires a template that references a blocked key. However, config-paths.ts already establishes that blocking these keys in path traversal is the project's security posture — this patch closes the gap in hooks-mapping.ts.

Fixes inconsistency between config-paths.ts:5 (BLOCKED_KEYS) and hooks-mapping.ts:getByPath (no blocklist).

Greptile Summary

Added prototype pollution protection to webhook template path resolution by blocking traversal into __proto__, constructor, and prototype keys in the getByPath function (hooks-mapping.ts:473-475). This mirrors the existing BLOCKED_KEYS protection in config-paths.ts:5 and prevents attacker-controlled webhook payloads from leaking data through these dangerous property names when referenced in hook mapping templates.

Introduced BLOCKED_PATH_KEYS constant matching the blocklist from config path traversal
Added early return when encountering blocked keys during path traversal
Three comprehensive test cases covering all three blocked keys
Defense-in-depth security improvement closing gap between config and webhook systems

Confidence Score: 5/5

This PR is safe to merge with minimal risk
The fix is a straightforward defense-in-depth security improvement that mirrors an existing security pattern from config-paths.ts. The implementation is correct, properly placed before property access, and includes comprehensive test coverage for all three blocked keys. The change is minimal, focused, and follows established codebase conventions.
No files require special attention

_{Last reviewed commit: bafa8d1}

_{(5/5) You can turn off certain types of comments like style here!}

…getByPath The getByPath() function in hooks-mapping.ts traverses attacker-controlled webhook payload data using arbitrary property path expressions, but does not filter dangerous property names (__proto__, constructor, prototype). The config-paths module (config-paths.ts) already blocks these exact keys for config path traversal via a BLOCKED_KEYS set, but the hooks template system was not protected with the same guard. Add a BLOCKED_PATH_KEYS set mirroring config-paths.ts and reject traversal into __proto__, prototype, or constructor in getByPath(). Add three test cases covering all three blocked keys. Signed-off-by: Alan Ross <alan@sleuthco.ai>

vincentkoc · 2026-02-21T07:57:18Z

@greptileai review

…getByPath (openclaw#22213) * security(hooks): block prototype-chain traversal in webhook template getByPath The getByPath() function in hooks-mapping.ts traverses attacker-controlled webhook payload data using arbitrary property path expressions, but does not filter dangerous property names (__proto__, constructor, prototype). The config-paths module (config-paths.ts) already blocks these exact keys for config path traversal via a BLOCKED_KEYS set, but the hooks template system was not protected with the same guard. Add a BLOCKED_PATH_KEYS set mirroring config-paths.ts and reject traversal into __proto__, prototype, or constructor in getByPath(). Add three test cases covering all three blocked keys. Signed-off-by: Alan Ross <alan@sleuthco.ai> * test(gateway): narrow hook action type in prototype-pollution tests * changelog: credit hooks prototype-path guard in PR 22213 * changelog: move hooks prototype-path fix into security section --------- Signed-off-by: Alan Ross <alan@sleuthco.ai> Co-authored-by: Vincent Koc <vincentkoc@ieee.org>

…getByPath (openclaw#22213) * security(hooks): block prototype-chain traversal in webhook template getByPath The getByPath() function in hooks-mapping.ts traverses attacker-controlled webhook payload data using arbitrary property path expressions, but does not filter dangerous property names (__proto__, constructor, prototype). The config-paths module (config-paths.ts) already blocks these exact keys for config path traversal via a BLOCKED_KEYS set, but the hooks template system was not protected with the same guard. Add a BLOCKED_PATH_KEYS set mirroring config-paths.ts and reject traversal into __proto__, prototype, or constructor in getByPath(). Add three test cases covering all three blocked keys. Signed-off-by: Alan Ross <alan@sleuthco.ai> * test(gateway): narrow hook action type in prototype-pollution tests * changelog: credit hooks prototype-path guard in PR 22213 * changelog: move hooks prototype-path fix into security section --------- Signed-off-by: Alan Ross <alan@sleuthco.ai> Co-authored-by: Vincent Koc <vincentkoc@ieee.org> (cherry picked from commit fe609c0)

…getByPath (openclaw#22213) * security(hooks): block prototype-chain traversal in webhook template getByPath The getByPath() function in hooks-mapping.ts traverses attacker-controlled webhook payload data using arbitrary property path expressions, but does not filter dangerous property names (__proto__, constructor, prototype). The config-paths module (config-paths.ts) already blocks these exact keys for config path traversal via a BLOCKED_KEYS set, but the hooks template system was not protected with the same guard. Add a BLOCKED_PATH_KEYS set mirroring config-paths.ts and reject traversal into __proto__, prototype, or constructor in getByPath(). Add three test cases covering all three blocked keys. Signed-off-by: Alan Ross <alan@sleuthco.ai> * test(gateway): narrow hook action type in prototype-pollution tests * changelog: credit hooks prototype-path guard in PR 22213 * changelog: move hooks prototype-path fix into security section --------- Signed-off-by: Alan Ross <alan@sleuthco.ai> Co-authored-by: Vincent Koc <vincentkoc@ieee.org>

…getByPath (openclaw#22213) * security(hooks): block prototype-chain traversal in webhook template getByPath The getByPath() function in hooks-mapping.ts traverses attacker-controlled webhook payload data using arbitrary property path expressions, but does not filter dangerous property names (__proto__, constructor, prototype). The config-paths module (config-paths.ts) already blocks these exact keys for config path traversal via a BLOCKED_KEYS set, but the hooks template system was not protected with the same guard. Add a BLOCKED_PATH_KEYS set mirroring config-paths.ts and reject traversal into __proto__, prototype, or constructor in getByPath(). Add three test cases covering all three blocked keys. Signed-off-by: Alan Ross <alan@sleuthco.ai> * test(gateway): narrow hook action type in prototype-pollution tests * changelog: credit hooks prototype-path guard in PR 22213 * changelog: move hooks prototype-path fix into security section --------- Signed-off-by: Alan Ross <alan@sleuthco.ai> Co-authored-by: Vincent Koc <vincentkoc@ieee.org> (cherry picked from commit fe609c0) # Conflicts: # CHANGELOG.md

…getByPath (openclaw#22213) * security(hooks): block prototype-chain traversal in webhook template getByPath The getByPath() function in hooks-mapping.ts traverses attacker-controlled webhook payload data using arbitrary property path expressions, but does not filter dangerous property names (__proto__, constructor, prototype). The config-paths module (config-paths.ts) already blocks these exact keys for config path traversal via a BLOCKED_KEYS set, but the hooks template system was not protected with the same guard. Add a BLOCKED_PATH_KEYS set mirroring config-paths.ts and reject traversal into __proto__, prototype, or constructor in getByPath(). Add three test cases covering all three blocked keys. Signed-off-by: Alan Ross <alan@sleuthco.ai> * test(gateway): narrow hook action type in prototype-pollution tests * changelog: credit hooks prototype-path guard in PR 22213 * changelog: move hooks prototype-path fix into security section --------- Signed-off-by: Alan Ross <alan@sleuthco.ai> Co-authored-by: Vincent Koc <vincentkoc@ieee.org> (cherry picked from commit fe609c0) # Conflicts: # CHANGELOG.md # src/gateway/hooks-mapping.ts

…getByPath (openclaw#22213) * security(hooks): block prototype-chain traversal in webhook template getByPath The getByPath() function in hooks-mapping.ts traverses attacker-controlled webhook payload data using arbitrary property path expressions, but does not filter dangerous property names (__proto__, constructor, prototype). The config-paths module (config-paths.ts) already blocks these exact keys for config path traversal via a BLOCKED_KEYS set, but the hooks template system was not protected with the same guard. Add a BLOCKED_PATH_KEYS set mirroring config-paths.ts and reject traversal into __proto__, prototype, or constructor in getByPath(). Add three test cases covering all three blocked keys. Signed-off-by: Alan Ross <alan@sleuthco.ai> * test(gateway): narrow hook action type in prototype-pollution tests * changelog: credit hooks prototype-path guard in PR 22213 * changelog: move hooks prototype-path fix into security section --------- Signed-off-by: Alan Ross <alan@sleuthco.ai> Co-authored-by: Vincent Koc <vincentkoc@ieee.org>

openclaw-barnacle bot added gateway Gateway runtime size: S labels Feb 20, 2026

vincentkoc added 3 commits February 21, 2026 02:47

Merge branch 'main' into security/hooks-getbypath-prototype-pollution

313be29

test(gateway): narrow hook action type in prototype-pollution tests

a92f2da

changelog: credit hooks prototype-path guard in PR 22213

e0f9f1c

changelog: move hooks prototype-path fix into security section

bafa8d1

vincentkoc merged commit fe609c0 into openclaw:main Feb 21, 2026
3 checks passed

github-actions bot mentioned this pull request Feb 21, 2026

📡 Upstream Digest — 2026-02-21 08:21 UTC curtismercier/openclaw-mods#85

Open

github-actions bot mentioned this pull request Feb 22, 2026

上游更新: v2026.2.21 — 32 P0 + 30 P1 待合并 jiulingyun/openclaw-cn#274

Closed

jiulingyun mentioned this pull request Feb 22, 2026

upstream(hooks): 移植 1 个冲突 commit (P0) — v2026.2.19→v2026.2.21 jiulingyun/openclaw-cn#282

Closed

6 tasks

Copilot AI mentioned this pull request Feb 22, 2026

[WIP] Port security commit for webhook template jiulingyun/openclaw-cn#285

Closed

SleuthCo mentioned this pull request Feb 22, 2026

security(cli): redact sensitive values in config get output #23654

Merged

3 tasks

steipete mentioned this pull request Feb 22, 2026

[Security] Information Disclosure: Prototype Chain Read via getByPath() in Hook Templates #20065

Closed

github-actions bot mentioned this pull request Mar 1, 2026

cherry-pick: upstream deps/security commits (2026-03-01-0443) hughdidit/DAISy-Agency#138

Closed

6 tasks

github-actions bot mentioned this pull request Mar 3, 2026

cherry-pick: upstream deps/security commits (2026-03-02-2346) hughdidit/DAISy-Agency#144

Closed

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

security(hooks): block prototype-chain traversal in webhook template getByPath#22213

security(hooks): block prototype-chain traversal in webhook template getByPath#22213
vincentkoc merged 5 commits intoopenclaw:mainfrom
SleuthCo:security/hooks-getbypath-prototype-pollution

SleuthCo commented Feb 20, 2026 •

edited by greptile-apps bot

Loading

Uh oh!

vincentkoc commented Feb 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

SleuthCo commented Feb 20, 2026 • edited by greptile-apps bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Vulnerability

PoC

Fix

Severity

Greptile Summary

Confidence Score: 5/5

Uh oh!

vincentkoc commented Feb 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

SleuthCo commented Feb 20, 2026 •

edited by greptile-apps bot

Loading