Update security-check.sh

security-check.sh

@@ -1,57 +1,25 @@
 #!/bin/sh
-
-# Security check - runs at startup, non-fatal, logs warnings only.
-
-PASS=0
+# 启动安全检查: 只打印警告, 不中断启动
 WARN=0
-
-log_ok()   { echo "[security] OK:   $1"; }
-log_warn() { echo "[security] WARN: $1"; WARN=$((WARN+1)); }
-
-# 1. Gateway token should be set and not too short
+warn() { echo "[security] WARN: $1"; WARN=$((WARN+1)); }
+ok()   { echo "[security] OK:   $1"; }
 
 TOKEN="${OPENCLAW_GATEWAY_TOKEN:-}"
 if [ -z "$TOKEN" ]; then
-log_warn "OPENCLAW_GATEWAY_TOKEN is not set - gateway is unprotected"
-elif [ ${#TOKEN} -lt 8 ]; then
-log_warn "OPENCLAW_GATEWAY_TOKEN is very short (< 8 chars), use a longer token"
+  warn "OPENCLAW_GATEWAY_TOKEN 未设置 - 将沿用旧配置里的令牌(不推荐)"
+elif [ "${#TOKEN}" -lt 32 ]; then
+  warn "OPENCLAW_GATEWAY_TOKEN 只有 ${#TOKEN} 位 - 现在登录只靠它, 请换成 32 位以上的字母数字"
+elif ! printf '%s' "$TOKEN" | grep -Eq '^[A-Za-z0-9]+$'; then
+  warn "OPENCLAW_GATEWAY_TOKEN 含特殊字符 - 建议只用字母数字"
 else
-log_ok "Gateway token is set (length=${#TOKEN})"
+  ok "网关令牌长度 ${#TOKEN}, 字母数字"
 fi
 
-# 2. HF_TOKEN should not be exposed as gateway token
-
-HF="${HF_TOKEN:-}"
-if [ -n "$HF" ] && [ "$HF" = "$TOKEN" ]; then
-log_warn "OPENCLAW_GATEWAY_TOKEN equals HF_TOKEN - use separate tokens"
+if [ -n "${HF_TOKEN:-}" ] && [ "$HF_TOKEN" = "$TOKEN" ]; then
+  warn "OPENCLAW_GATEWAY_TOKEN 与 HF_TOKEN 相同 - 请分开"
 fi
 
-# 3. Config file should not contain raw API keys in plaintext paths
-
 CONFIG="${OPENCLAW_HOME:-/home/user}/.openclaw/openclaw.json"
-if [ -f "$CONFIG" ]; then
-
-# warn if any obvious key pattern found outside env.vars block
-
-if grep -q '"_API_KEY"' "$CONFIG" 2>/dev/null; then
-log_warn "openclaw.json may contain raw API keys - prefer env vars"
-else
-log_ok "openclaw.json looks clean (no raw API keys)"
-fi
-fi
-
-# 4. Warn if allowedOrigins is wildcard in production
-
-if grep -q '"allowedOrigins": \["\*"\]' "$CONFIG" 2>/dev/null; then
-log_warn "controlUi.allowedOrigins=[\"*\"] - consider locking to your Space URL"
-fi
-
-# 5. Check file permissions on sensitive files
-
-if [ -f "$CONFIG" ]; then
-PERMS=$(stat -c "%a" "$CONFIG" 2>/dev/null || stat -f "%A" "$CONFIG" 2>/dev/null || echo "unknown")
-log_ok "openclaw.json permissions: $PERMS"
-fi
-
-echo "[security] Check complete: $WARN warning(s)"
+[ -f "$CONFIG" ] && ok "openclaw.json 权限: $(stat -c %a "$CONFIG" 2>/dev/null || echo unknown)"
+echo "[security] 检查完成: $WARN 条警告"
 exit 0