$ the-wire · showcase
Linear-time glob matching closes O(n^k) ReDoS in session visibility
By RepoJournal · Filed · About OpenClaw
OpenClaw replaced regex wildcard matching with a linear-time glob matcher in session-visibility, fixing a polynomial backtracking vulnerability in the agentToAgent allow-pattern check.
The agentToAgent allow-pattern matcher used to convert wildcards like `*a*b*c*` into a RegExp such as `^.*a.*b.*c.*$`, whose overlapping `.*` groups could cause O(n^k) polynomial backtracking against non-matching input. It now uses a segment-based glob matcher that splits on `*` and runs in O(n*k), closing the denial-of-service vector [1].
Proxy completions caps are now clamped against the estimated final outbound request payload after compatibility transforms, preventing strict servers from rejecting requests where the prompt already consumes part of the context window [2]. Plugin gateway handlers that return a value now complete `openclaw gateway call` instead of leaving it waiting until timeout [3], and Anthropic-compatible replay preserves the latest thinking signature while stripping invalid ones from older turns, with a retry on signature rejection [4].
Crabbox added `provider: upstash-box` as a delegated Upstash Box runner with full run/warmup/list/status/stop support [7], and WebVNC desktops now sync themes with system dark/light mode, seeding XFCE, GTK, GSettings, and terminal themes [6]. Run failures in codex are classified into install, SSH, provider auth, model-call, and unknown blockers, with Cloudflare Access challenge bodies redacted from failure tails [5]. ocm's `dev watch` can now take over existing environments [8].
Action items
- → Upgrade OpenClaw to pick up the linear-time glob matcher before relying on agentToAgent allow patterns in untrusted input openclaw/openclaw [immediate]
- → Review plugin gateway handlers for returned values to ensure they complete calls openclaw/openclaw [plan]
- → Evaluate the new Upstash Box provider for environments using that runner openclaw/crabbox [plan]
References
- [1] fix(security): replace regex wildcard matching with linear-time glob in session-visibility ↗ openclaw/openclaw
- [2] fix(agents): clamp proxy completions caps after payload shaping (#85889) ↗ openclaw/openclaw
- [3] fix(plugins): return plugin gateway method results ↗ openclaw/openclaw
- [4] fix(agents): preserve latest thinking replay signatures ↗ openclaw/openclaw
- [5] [codex] classify run failures and env forwarding ↗ openclaw/crabbox
- [6] feat: sync WebVNC themes with system settings ↗ openclaw/crabbox
- [7] feat: add Upstash Box provider ↗ openclaw/crabbox
- [8] feat: let dev watch take over existing envs ↗ openclaw/ocm
