github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-04-18 10:37:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

bluebubbles: harden local media path handling against LFI (#16322)

Browse Source 
* bluebubbles: harden local media path handling

* bluebubbles: remove racy post-open symlink lstat

* fix: bluebubbles mediaLocalRoots docs + typing fix (#16322) (thanks @mbelinky)
This commit is contained in:
Mariano
2026-02-14 17:43:44 +00:00
committed by GitHub
parent bfa7d21e99
commit 71f357d949
7 changed files with 417 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
docs/channels/bluebubbles.md
View File

@@ -300,6 +300,7 @@ Provider options:
- `channels.bluebubbles.textChunkLimit`: Outbound chunk size in chars (default: 4000).
- `channels.bluebubbles.chunkMode`: `length` (default) splits only when exceeding `textChunkLimit`; `newline` splits on blank lines (paragraph boundaries) before length chunking.
- `channels.bluebubbles.mediaMaxMb`: Inbound media cap in MB (default: 8).
- `channels.bluebubbles.mediaLocalRoots`: Explicit allowlist of absolute local directories permitted for outbound local media paths. Local path sends are denied by default unless this is configured. Per-account override: `channels.bluebubbles.accounts.<accountId>.mediaLocalRoots`.
- `channels.bluebubbles.historyLimit`: Max group messages for context (0 disables).
- `channels.bluebubbles.dmHistoryLimit`: DM history limit.
- `channels.bluebubbles.actions`: Enable/disable specific actions.