Skip to content

fix(security): throw on config validation failure instead of returning empty config#9040

Closed
joetomasone wants to merge 1 commit intoopenclaw:mainfrom
joetomasone:fix/config-validation-fail-closed
Closed

fix(security): throw on config validation failure instead of returning empty config#9040
joetomasone wants to merge 1 commit intoopenclaw:mainfrom
joetomasone:fix/config-validation-fail-closed

Conversation

@joetomasone
Copy link
Contributor

@joetomasone joetomasone commented Feb 4, 2026

Security Issue

Fixes #5052

When loadConfig() failed validation (e.g., due to invalid plugin references), it returned {} instead of propagating the error. This caused all security settings to fall back to permissive defaults:

  • dmPolicy defaulted to "pairing" — any sender could get a pairing code
  • allowFrom was ignored — allowlist protection bypassed
  • groupPolicy was ignored — group restrictions bypassed

Root Cause

} catch (err) {
  if (error?.code === "INVALID_CONFIG") {
    return {};  // ← Security settings wiped
  }
  return {};    // ← Also on read errors
}

Fix

Throw the error instead of returning empty config:

} catch (err) {
  if (error?.code === "INVALID_CONFIG") {
    // SECURITY: Do not return {} on validation failure.
    throw err;
  }
  // SECURITY: Do not return {} on read failure either.
  throw err;
}

Impact

BREAKING CHANGE: loadConfig() now throws on validation failure instead of returning {}.

  • Gateway startup already handles this correctly (refuses to start with invalid config)
  • Runtime callers must now handle the exception
  • This is intentional — operating with no security is worse than crashing

Compatibility with #9036

This pairs well with PR #9036 (systemd restart limits). If config is invalid:

  1. Gateway throws and refuses to start
  2. Systemd restarts it (up to 5 times in 5 minutes)
  3. After hitting the limit, manual intervention required

This is the correct fail-closed behavior for a security-critical system.

@joetomasone
fix(security): throw on config validation failure instead of returnin…
4aabb87 
…g empty config

BREAKING CHANGE: loadConfig() now throws on validation failure instead of
returning {}.

Previously, when config validation failed (e.g., invalid plugin references),
loadConfig() returned {} which caused all security settings (dmPolicy,
allowFrom, groupPolicy) to fall back to permissive defaults. This allowed
unauthorized senders to receive pairing codes or messages.

Now, validation failures propagate as exceptions. Callers must handle the
error explicitly rather than silently operating with no access control.

Fixes openclaw#5052
@sebslight sebslight mentioned this pull request Feb 13, 2026
Closed
5 tasks
@yash27-lab yash27-lab mentioned this pull request Feb 17, 2026
Closed
4 tasks
@openclaw-barnacle
Copy link

openclaw-barnacle bot commented Feb 21, 2026

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

@openclaw-barnacle openclaw-barnacle bot added the stale Marked as stale due to inactivity label Feb 21, 2026
@joetomasone
Copy link
Contributor Author

joetomasone commented Feb 21, 2026

Friendly bump — this PR is still active and ready for review. Happy to address any feedback.

@openclaw-barnacle openclaw-barnacle bot removed the stale Marked as stale due to inactivity label Feb 24, 2026
@mudrii

This comment was marked as spam.

Sign in to view
@openclaw-barnacle
Copy link

openclaw-barnacle bot commented Mar 7, 2026

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

@openclaw-barnacle openclaw-barnacle bot added the stale Marked as stale due to inactivity label Mar 7, 2026
steipete added a commit that referenced this pull request Mar 7, 2026
@steipete @joetomasone
fix(config): fail closed on invalid config load (#9040, thanks @joeto…
f53e10e 
…masone)

Land #9040 by @joetomasone. Add fail-closed config loading, compat coverage, and changelog entry for #5052.

Co-authored-by: Joe Tomasone <[email protected]>
@steipete
Copy link
Contributor

steipete commented Mar 7, 2026

Landed on main.

What I did:

  • rebased the fix onto current main
  • kept the fail-closed loadConfig() behavior from this PR
  • added regression coverage for invalid-config fail-closed behavior and updated compat coverage
  • added a changelog entry
  • ran pnpm lint, pnpm build, and pnpm test before landing

Hashes:

  • landed commit on main: f53e10e3fd753d91fe1858d46511586458402f01
  • original PR commit: 4aabb877d84fbb525d3f12d8d336dc6476313eb3

Thanks @joetomasone.

@steipete steipete closed this Mar 7, 2026
This was referenced Mar 7, 2026
Closed
Closed
vincentkoc pushed a commit to BryanTegomoh/openclaw-fork that referenced this pull request Mar 8, 2026
@steipete @joetomasone @vincentkoc
fix(config): fail closed on invalid config load (openclaw#9040, thanks …
15a4d0b 
…@joetomasone)

Land openclaw#9040 by @joetomasone. Add fail-closed config loading, compat coverage, and changelog entry for openclaw#5052.

Co-authored-by: Joe Tomasone <[email protected]>
ziomancer pushed a commit to ziomancer/openclaw that referenced this pull request Mar 8, 2026
@steipete @joetomasone @ziomancer
fix(config): fail closed on invalid config load (openclaw#9040, thanks …
8caac9a 
…@joetomasone)

Land openclaw#9040 by @joetomasone. Add fail-closed config loading, compat coverage, and changelog entry for openclaw#5052.

Co-authored-by: Joe Tomasone <[email protected]>
openperf pushed a commit to openperf/moltbot that referenced this pull request Mar 8, 2026
@steipete @joetomasone @openperf
fix(config): fail closed on invalid config load (openclaw#9040, thanks …
d1a78a6 
…@joetomasone)

Land openclaw#9040 by @joetomasone. Add fail-closed config loading, compat coverage, and changelog entry for openclaw#5052.

Co-authored-by: Joe Tomasone <[email protected]>
mcaxtr pushed a commit to mcaxtr/openclaw that referenced this pull request Mar 8, 2026
@steipete @joetomasone @mcaxtr
fix(config): fail closed on invalid config load (openclaw#9040, thanks …
3015c89 
…@joetomasone)

Land openclaw#9040 by @joetomasone. Add fail-closed config loading, compat coverage, and changelog entry for openclaw#5052.

Co-authored-by: Joe Tomasone <[email protected]>
@github-actions github-actions bot mentioned this pull request Mar 8, 2026
Open
Saitop pushed a commit to NomiciAI/openclaw that referenced this pull request Mar 8, 2026
@steipete @joetomasone
fix(config): fail closed on invalid config load (openclaw#9040, thanks …
0915972 
…@joetomasone)

Land openclaw#9040 by @joetomasone. Add fail-closed config loading, compat coverage, and changelog entry for openclaw#5052.

Co-authored-by: Joe Tomasone <[email protected]>
GordonSH-oss pushed a commit to GordonSH-oss/openclaw that referenced this pull request Mar 9, 2026
@steipete @joetomasone @GordonSH-oss
fix(config): fail closed on invalid config load (openclaw#9040, thanks …
1682bf8 
…@joetomasone)

Land openclaw#9040 by @joetomasone. Add fail-closed config loading, compat coverage, and changelog entry for openclaw#5052.

Co-authored-by: Joe Tomasone <[email protected]>
jenawant pushed a commit to jenawant/openclaw that referenced this pull request Mar 10, 2026
@steipete @joetomasone @jenawant
fix(config): fail closed on invalid config load (openclaw#9040, thanks …
3639eeb 
…@joetomasone)

Land openclaw#9040 by @joetomasone. Add fail-closed config loading, compat coverage, and changelog entry for openclaw#5052.

Co-authored-by: Joe Tomasone <[email protected]>
@alexey-pelykh alexey-pelykh mentioned this pull request Mar 10, 2026
Open
4 tasks
dhoman pushed a commit to dhoman/chrono-claw that referenced this pull request Mar 11, 2026
@steipete @joetomasone @dhoman
fix(config): fail closed on invalid config load (openclaw#9040, thanks …
3bc7831 
…@joetomasone)

Land openclaw#9040 by @joetomasone. Add fail-closed config loading, compat coverage, and changelog entry for openclaw#5052.

Co-authored-by: Joe Tomasone <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

stale Marked as stale due to inactivity

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Config validation failure silently drops security settings to insecure defaults

3 participants

@joetomasone @mudrii @steipete