OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections
Trailing-dot localhost handling in remote CDP websocket normalization lets a hostile discovery response bypass loopback-host rewriting and steer a follow-up browser-control connection back to localhost.
extensions/browser/src/browser/cdp.ts
This is the browser CDP URL normalization path referenced by the new test. It consumes the discovery-provided websocket URL and decides whether loopback-like hosts such as localhost should be rewritten back to the configured remote host.
src/gateway/net.ts
The fix lands here: shared host parsing and loopback checks previously treated only exact localhost as loopback, so absolute-form hosts like localhost. were not canonicalized before the protection decision.