-
-
Notifications
You must be signed in to change notification settings - Fork 128
fix: Storage safety, gateway stability, auth UX, canvas, deps (#21, #54, #55, #56, #59, #60, #61, #63, #64, #65, #66, #67) #57
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from 3 commits
a89e595
a94c515
448d679
1201009
0c94229
720d89d
5e8144f
0140474
67a3969
1f41fe7
5980af5
ecd552f
60852aa
3618c93
414dd17
33773de
6418a81
8409df6
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| <?xml version="1.0" encoding="utf-8"?> | ||
| <resources> | ||
| <usb-device /> | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. P2: Overly permissive USB device filter — Consider restricting to common USB-serial adapter vendor/product IDs (FTDI, CP210x, CH340, PL2303) or at minimum filtering by device class. For example: Prompt for AI agents |
||
| </resources> | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: mithun50/openclaw-termux
Length of output: 28665
Exclude sensitive tokens from backups.
android:allowBackup="true"on Line 35 can expose persisted authentication tokens (nodeGatewayToken,dashboardUrlcontaining token fragments,nodeDeviceToken) and configuration (openclaw.json) unless backup rules explicitly exclude them. Currently, no backup rule resources exist.🔐 Suggested manifest hardening
<application android:label="OpenClaw" android:name="${applicationName}" android:icon="@mipmap/ic_launcher" android:usesCleartextTraffic="true" android:requestLegacyExternalStorage="true" android:extractNativeLibs="true" - android:allowBackup="true"> + android:allowBackup="true" + android:fullBackupContent="@xml/backup_rules" + android:dataExtractionRules="@xml/data_extraction_rules">Create
flutter_app/android/app/src/main/res/xml/backup_rules.xmlandflutter_app/android/app/src/main/res/xml/data_extraction_rules.xmlto exclude SharedPreferences keys containing tokens and sensitive configuration.🤖 Prompt for AI Agents