OpenClaw has agent avatar symlink traversal in gateway session metadata

Summary

## Summary A crafted local avatar path could follow a symlink outside the agent workspace and return arbitrary file contents as a base64 `data:` URL in gateway responses. ## Impact - Confidentiality impact: local file read in the gateway process context. - Exfiltration path: `agents.list` can return the resulting `avatarUrl` payload. ## Affected Components - `src/gateway/session-utils.ts` (`resolveIdentityAvatarUrl`) ## Affected Packages / Versions - Package: `openclaw` (npm) - Introduced: `v2026.1.21` - Affected published versions: `<= 2026.2.21-2` - Planned patched version: `2026.2.22` ## Remediation - Resolve workspace and avatar paths with `realpath` and enforce realpath containment. - Open files with `O_NOFOLLOW` when available. - Compare pre-open and opened file identity (`dev`/`ino`) to block swap races. - Add regression tests for outside-workspace symlink rejection and in-workspace symlink allowance. ## Fix Commit(s) - `3d0337504349954237d09e4d957df5cb844d5e77` OpenClaw thanks @aether-ai-agent for reporting.