不是翻译 —— 多数文档描述的行为已经不存在了。 先修一个更基本的问题：我们不拥有 u-claw.org 域名，那是上游的。所以之前写在 README、诊断包提示、联系方式里的 help@u-claw.org 全都会把用户的问题发给 上游 —— 一个没有理由回复的人。改为指向我们自己的 issue tracker，并加断言 禁止再出现指向该域名的支持入口。 重写（内容过时，不是语言问题）： - install/README.md —— 还写着 10 个中国技能、DeepSeek 优先、国内镜像。 现在按实际流程写：技能读 manifest、模型菜单 Gemini 优先、bundle 有 SHA256 校验。并如实写明 curl|bash 在受管企业电脑上会被 EDR 拦。 - CLAUDE.md 的模型配置整节 —— 还在描述虾盘云首选卡片和 12 个 provider， 那个界面已经换成单框 Key 输入了。 - SECURITY.md —— 安全报告原本指向上游维护者个人邮箱。fork 之后那条路由 是错的：漏洞会发给写不了这份代码、也修不了的人。 - CONTRIBUTING.md —— 补上 fork 关系、pre-push 钩子怎么装、以及 `node --test tests/` 为什么不能用。 翻译并保留： - bootable/README.md、TROUBLESHOOTING.md —— 面向用户，顺带把 「国内镜像」「小米/华为 BIOS 按键」等换成目标市场的实际情况 HANDOFF.md 重写为一份事故复盘：原文一半是过时的一次性交接笔记（引用的 website/guide.html 已不在本仓库），另一半是 persistence.dat 未格式化导致 启动失败的排查记录 —— 后者有长期价值，尤其是「读 offset 1080 的两字节 验证 ext4」这个判断方法，已同时写进 bootable/README.md。 bootable/IMPROVEMENTS_SUMMARY.md 保留中文，加了说明：它是上游 fork 前的 历史改进记录，没人引用，描述的是已完成的工作而非当前行为。翻译它反而会 让人误以为是现行文档。 新增 skills/en/uclaw-help —— 把「怎么用、东西在哪、出问题怎么办」做成 内置知识，每个角色都装。方案 C10.8：能问的产品才是不需要学的产品。
This commit is contained in:
100
SECURITY.md
100
SECURITY.md
@@ -1,61 +1,71 @@
|
||||
# 安全策略 / Security Policy
|
||||
# Security policy
|
||||
|
||||
感谢你关注 U-Claw 的安全性。本文档说明如何向我们报告安全漏洞，以及我们当前支持的版本。
|
||||
## Reporting a vulnerability
|
||||
|
||||
## 报告漏洞 / Reporting a Vulnerability
|
||||
**Please do not put details in a public issue.**
|
||||
|
||||
**请不要在公开 issue 里发布安全漏洞细节。**
|
||||
Open a report at
|
||||
https://gitea.fanghe.it.com/zhenghy/u-claw/issues — mark it clearly as a
|
||||
security report and keep the details minimal until we can arrange a private
|
||||
channel.
|
||||
|
||||
如果你发现了 U-Claw 的安全问题，请通过以下任一渠道私下联系：
|
||||
> **This is a fork.** Upstream is `github.com/dongsheng123132/u-claw`. If the
|
||||
> issue is in code we inherited unchanged, it affects their users too — please
|
||||
> tell them as well. If it is in something this fork changed (the launcher, the
|
||||
> i18n layer, the skill installer, the key-check endpoint, the self-heal
|
||||
> routines), it is ours.
|
||||
>
|
||||
> We do not yet have a dedicated security address of our own. `origin.json`
|
||||
> records that gap; until it is filled, the issue tracker is the route.
|
||||
|
||||
- 邮件：`hefangsheng@u-claw.org`（建议附 PoC、影响范围、复现步骤）
|
||||
- GitHub 私密漏洞报告：在 [u-claw 仓库](https://gitea.fanghe.it.com/zhenghy/u-claw) 的 Security 标签页 → "Report a vulnerability"
|
||||
We will acknowledge within **3 working days** and give a first assessment within
|
||||
**14 days**. Please give us a chance to fix it before disclosing publicly.
|
||||
|
||||
我们会在 **3 个工作日内** 确认收到，并在 **14 天内** 给出初步评估。请允许我们在公开披露前修复问题。
|
||||
### What helps
|
||||
|
||||
### 报告内容建议
|
||||
- Which module — `portable/`, `install/`, `bootable/`
|
||||
- Version or commit hash
|
||||
- How it is triggered, and from where: local, LAN, or the internet
|
||||
- Steps to reproduce, or a proof of concept
|
||||
- What you think the fix looks like, if you have a view
|
||||
|
||||
- 受影响的模块（portable / install / bootable / u-claw-app）
|
||||
- 受影响的版本或 commit hash
|
||||
- 触发条件、攻击面（本地 / 局域网 / 互联网）
|
||||
- 复现步骤或 PoC 代码
|
||||
- 你建议的缓解或修复方向
|
||||
## What is in scope
|
||||
|
||||
## 支持的版本 / Supported Versions
|
||||
- Command injection, path traversal, arbitrary write or code execution in
|
||||
U-Claw's own scripts
|
||||
- Injection through the loading or writing of `data/.openclaw/openclaw.json`
|
||||
- Launchers (`START HERE - *`, `lib/start.mjs`) being hijacked through a
|
||||
malicious directory name or environment variable
|
||||
- Man-in-the-middle exposure on the one-line install path
|
||||
(`curl | bash`, `irm | iex`)
|
||||
- Privilege escalation in what the bootable USB scripts produce
|
||||
- The key-check endpoint (`/api/test-key`) — it handles API keys server-side
|
||||
- The diagnostics report leaking a secret it should have redacted
|
||||
|
||||
| 模块 | 版本 | 状态 |
|
||||
|------|------|------|
|
||||
| `portable/` | 当前 main | ✅ 接受报告 |
|
||||
| `install/` (`install.sh` / `install.ps1`) | 当前 main | ✅ 接受报告 |
|
||||
| `bootable/` (Linux U 盘) | 当前 main | ✅ 接受报告 |
|
||||
| `u-claw-app/` Electron | 当前 main | ✅ 接受报告 |
|
||||
| 历史 release tag | — | ⚠️ 仅做严重等级评估，不一定回滚补丁 |
|
||||
## What is not
|
||||
|
||||
我们暂未发布稳定版本号，所有修复直接在 main 分支推送。
|
||||
- **Upstream dependencies** — Node.js, OpenClaw, Electron, Ventoy, Ubuntu.
|
||||
Report those to their projects; we track and upgrade versions.
|
||||
- **A user publishing their own API key** in a screenshot or a public repo.
|
||||
- **Physical access to the drive.** If someone has the drive, they have the
|
||||
data — that is the trade a portable product makes, and it is stated plainly
|
||||
in the README rather than defended against.
|
||||
- **What an attacker can do once they already have admin or root** on the
|
||||
machine.
|
||||
|
||||
## 范围 / In-Scope vs Out-of-Scope
|
||||
## Supported
|
||||
|
||||
### 在范围内（请报告）
|
||||
| Module | Status |
|
||||
|---|---|
|
||||
| `portable/` | current `main` — reports accepted |
|
||||
| `install/` | current `main` — reports accepted |
|
||||
| `bootable/` | current `main` — reports accepted |
|
||||
| `u-claw-app/` | **deprecated 2026-06-19**, no longer built or published |
|
||||
| older tags | severity assessed, but no backported patches |
|
||||
|
||||
- U-Claw 自身脚本中的命令注入、路径穿越、任意写入、代码执行
|
||||
- `data/.openclaw/openclaw.json` 配置加载/写入逻辑中的注入
|
||||
- 启动脚本（`Mac-Start.command` / `Windows-Start.bat` / `start.sh`）
|
||||
在恶意目录名/环境变量下被劫持的可能
|
||||
- 一键安装 (`curl | bash` / `irm | iex`) 链路上的 MITM 风险
|
||||
- Bootable USB 制作脚本生成的产物在 Linux Live 环境下的提权问题
|
||||
There are no stable version numbers yet; fixes go straight to `main`.
|
||||
|
||||
### 不在范围内
|
||||
## Credit
|
||||
|
||||
- 上游依赖（Node.js / OpenClaw / Electron / Ventoy / Ubuntu）的漏洞 —
|
||||
请直接报给上游项目；我们只跟踪并升级版本。
|
||||
- 用户主动把自己的 API Key 写到公开仓库 / 截图泄露，不属于本项目缺陷。
|
||||
- 物理接触 USB 后的所有攻击（含偷换 USB、键盘记录等），属于硬件安全场景。
|
||||
- 在用户已经获得 admin/root 权限的情况下能做的进一步动作。
|
||||
|
||||
## 致谢 / Acknowledgements
|
||||
|
||||
发现并负责任披露安全问题的研究者，将在修复发布的 commit message 和 release notes 中署名感谢（除非你要求匿名）。
|
||||
|
||||
---
|
||||
|
||||
> 本策略借鉴了 GitHub 推荐的开源安全披露格式，未来会随项目成熟度更新。
|
||||
Anyone who reports responsibly is credited in the fixing commit and the release
|
||||
notes, unless you would rather not be.
|
||||
|
||||
Reference in New Issue
Block a user