提交 #862538: nextlevelbuilder GoClaw 3.13.2 Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)

# Technical Details
A Sensitive Credential Exposure via Auto-Approved Safe Binary exists in the `ExecApprovalManager.CheckCommand()` method in `internal/tools/exec_approval.go` and the `executeOnHost()` method in `internal/tools/shell.go` of GoClaw.

The application fails to prevent environment secret disclosure through auto-approved safe binaries. When `tools.execApproval.security=full` and `tools.execApproval.ask=on-miss`, `jq` is hardcoded as a safe binary and auto-approved. The static credential environment scrub list in `internal/tools/env_scrub.go` omits `GOCLAW_GATEWAY_TOKEN` and `GOCLAW_ENCRYPTION_KEY`, so these secrets remain in the child process environment when `executeOnHost()` spawns `/bin/sh -c <command>`. An authenticated operator can invoke `jq -nr '$ENV.GOCLAW_GATEWAY_TOKEN'` via `POST /v1/tools/invoke` to read the gateway bearer token.

# Vulnerable Code
File: internal/tools/exec_approval.go
Method: CheckCommand() — `jq` classified as safe binary and auto-approved in ExecSecurityFull + ExecAskOnMiss mode without semantic validation
File: internal/tools/env_scrub.go
Method: scrubCredentialEnv() — static credential scrub list omits GOCLAW_GATEWAY_TOKEN and GOCLAW_ENCRYPTION_KEY
Why: Safe binary classification trusts `jq` unconditionally, and the env scrub list does not include GoClaw's own process secrets. Together, these allow `jq $ENV` to read unprotected gateway tokens through the normal tool execution path.

# Reproduction
1. Deploy GoClaw with `tools.execApproval.security=full` and `tools.execApproval.ask=on-miss`.
2. Ensure `GOCLAW_GATEWAY_TOKEN` is set in the gateway process environment and `jq` is available on the host.
3. Authenticate as an operator and send `{"tool":"exec","args":{"command":"jq -nr '$ENV.GOCLAW_GATEWAY_TOKEN'"}}` to `POST /v1/tools/invoke`.
4. Observe HTTP 200 response with the live gateway token in `result.output`.
5. Confirm a control request using `echo $GOCLAW_GATEWAY_TOKEN` is rejected with HTTP 400, proving this is a policy bypass specific to the auto-approved `jq` path.

# Impact
- Sensitive credential exposure: an authenticated operator can steal the gateway bearer token and escalate to broader HTTP/WebSocket gateway control.
- The same path can expose `GOCLAW_ENCRYPTION_KEY` and other GoClaw runtime secrets preserved in the host process environment.
- This defeats the exec approval security model by exploiting the safe binary trust boundary.

• 来源: ⚠️ https://github.com/nextlevelbuilder/goclaw/issues/1226
• 用户: Erichen-apple (UID 99087)
• 提交: 2026-06-18 08時32分 (1 月前)
• 管理: 2026-07-28 10時32分 (1 month later)
• 状态: 已接受
• VulDB条目: 383813 [nextlevelbuilder GoClaw 直到 3.13.2 jq Handler tools_invoke.go ExecTool.Execute 信息公开]
• 积分: 20