fix: harden WhatsApp accountId auth dir (#4610) (thanks @leszekszpunar)

Apply normalizeAccountId() from routing/session-key to
resolveDefaultAuthDir() so that malicious config values like
"../../../etc" cannot escape the intended auth directory.

Fixes #2692

CHANGELOG.md

@@ -15,6 +15,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- Web: sanitize WhatsApp accountId auth directories and preserve legacy casing. (#4610) Thanks @leszekszpunar.
 - Auto-reply: avoid referencing workspace files in /new greeting prompt. (#5706) Thanks @bravostation.
 - Process: resolve Windows `spawn()` failures for npm-family CLIs by appending `.cmd` when needed. (#5815) Thanks @thejhinvirtuoso.
 - Discord: resolve PluralKit proxied senders for allowlists and labels. (#5838) Thanks @thewilloftheshadow.

src/web/accounts.test.ts

@@ -0,0 +1,77 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { resolveWhatsAppAuthDir } from "./accounts.js";
+
+describe("resolveWhatsAppAuthDir", () => {
+  const stubCfg = { channels: { whatsapp: { accounts: {} } } } as Parameters<
+    typeof resolveWhatsAppAuthDir
+  >[0]["cfg"];
+  let prevOauthDir: string | undefined;
+  let tempOauthDir: string;
+
+  beforeEach(() => {
+    prevOauthDir = process.env.OPENCLAW_OAUTH_DIR;
+    tempOauthDir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-auth-"));
+    process.env.OPENCLAW_OAUTH_DIR = tempOauthDir;
+  });
+
+  afterEach(() => {
+    if (prevOauthDir === undefined) {
+      delete process.env.OPENCLAW_OAUTH_DIR;
+    } else {
+      process.env.OPENCLAW_OAUTH_DIR = prevOauthDir;
+    }
+  });
+
+  it("sanitizes path traversal sequences in accountId", () => {
+    const { authDir } = resolveWhatsAppAuthDir({
+      cfg: stubCfg,
+      accountId: "../../../etc/passwd",
+    });
+    const baseDir = path.join(tempOauthDir, "whatsapp");
+    const relative = path.relative(baseDir, authDir);
+    // Sanitized accountId must stay under the whatsapp auth directory.
+    expect(relative.startsWith("..")).toBe(false);
+    expect(path.isAbsolute(relative)).toBe(false);
+  });
+
+  it("sanitizes special characters in accountId", () => {
+    const { authDir } = resolveWhatsAppAuthDir({
+      cfg: stubCfg,
+      accountId: "foo/bar\\baz",
+    });
+    // Check sanitization on the accountId segment, not the full path (Windows uses backslash).
+    const segment = path.basename(authDir);
+    expect(segment).not.toContain("/");
+    expect(segment).not.toContain("\\");
+    expect(segment).toBe("foo-bar-baz");
+  });
+
+  it("returns default directory for empty accountId", () => {
+    const { authDir } = resolveWhatsAppAuthDir({
+      cfg: stubCfg,
+      accountId: "",
+    });
+    expect(authDir).toMatch(/whatsapp[/\\]default$/);
+  });
+
+  it("preserves valid accountId unchanged", () => {
+    const { authDir } = resolveWhatsAppAuthDir({
+      cfg: stubCfg,
+      accountId: "my-account-1",
+    });
+    expect(authDir).toMatch(/whatsapp[/\\]my-account-1$/);
+  });
+
+  it("keeps legacy casing when a matching auth directory exists", () => {
+    const legacyDir = path.join(tempOauthDir, "whatsapp", "Work");
+    fs.mkdirSync(legacyDir, { recursive: true });
+    const { authDir } = resolveWhatsAppAuthDir({
+      cfg: stubCfg,
+      accountId: "Work",
+    });
+    expect(authDir).toBe(legacyDir);
+  });
+});

src/web/accounts.ts

@@ -3,7 +3,7 @@ import path from "node:path";
 import type { OpenClawConfig } from "../config/config.js";
 import type { DmPolicy, GroupPolicy, WhatsAppAccountConfig } from "../config/types.js";
 import { resolveOAuthDir } from "../config/paths.js";
-import { DEFAULT_ACCOUNT_ID } from "../routing/session-key.js";
+import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "../routing/session-key.js";
 import { resolveUserPath } from "../utils.js";
 import { hasWebCredsSync } from "./auth-store.js";
 
@@ -29,6 +29,8 @@ export type ResolvedWhatsAppAccount = {
   debounceMs?: number;
 };
 
+const SAFE_ACCOUNT_SEGMENT_RE = /^[a-z0-9_-]+$/i;
+
 function listConfiguredAccountIds(cfg: OpenClawConfig): string[] {
   const accounts = cfg.channels?.whatsapp?.accounts;
   if (!accounts || typeof accounts !== "object") {
@@ -95,7 +97,30 @@ function resolveAccountConfig(
 }
 
 function resolveDefaultAuthDir(accountId: string): string {
-  return path.join(resolveOAuthDir(), "whatsapp", accountId);
+  const baseDir = path.join(resolveOAuthDir(), "whatsapp");
+  const normalized = normalizeAccountId(accountId);
+  const normalizedDir = path.join(baseDir, normalized);
+
+  const trimmed = accountId.trim();
+  if (trimmed && trimmed !== normalized && SAFE_ACCOUNT_SEGMENT_RE.test(trimmed)) {
+    const legacyDir = path.join(baseDir, trimmed);
+    try {
+      if (fs.existsSync(legacyDir)) {
+        if (!fs.existsSync(normalizedDir)) {
+          return legacyDir;
+        }
+        const legacyStat = fs.statSync(legacyDir);
+        const normalizedStat = fs.statSync(normalizedDir);
+        if (legacyStat.dev === normalizedStat.dev && legacyStat.ino === normalizedStat.ino) {
+          return legacyDir;
+        }
+      }
+    } catch {
+      // ignore fs errors and fall back to normalized path
+    }
+  }
+
+  return normalizedDir;
 }
 
 function resolveLegacyAuthDir(): string {