github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-13 22:46:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

security(telegram): fail closed group allowlist against DM pairing store

Browse Source
This commit is contained in:
bmendonca3
2026-02-24 19:07:20 -07:00
committed by Ayaan Zaidi
parent 5500000492
commit c7352f6b3f
3 changed files with 36 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/telegram/bot-message-context.ts
View File

@@ -36,7 +36,12 @@ import { recordChannelActivity } from "../infra/channel-activity.js";
import { resolveAgentRoute } from "../routing/resolve-route.js";
import { resolveThreadSessionKeys } from "../routing/session-key.js";
import { withTelegramApiErrorLogging } from "./api-logging.js";
import { firstDefined, isSenderAllowed, normalizeAllowFromWithStore } from "./bot-access.js";
import {
firstDefined,
isSenderAllowed,
normalizeAllowFrom,
normalizeAllowFromWithStore,
} from "./bot-access.js";
import {
buildGroupLabel,
buildSenderLabel,
@@ -189,11 +194,8 @@ export const buildTelegramMessageContext = async ({
const mentionRegexes = buildMentionRegexes(cfg, route.agentId);
const effectiveDmAllow = normalizeAllowFromWithStore({ allowFrom, storeAllowFrom, dmPolicy });
const groupAllowOverride = firstDefined(topicConfig?.allowFrom, groupConfig?.allowFrom);
const effectiveGroupAllow = normalizeAllowFromWithStore({
allowFrom: groupAllowOverride ?? groupAllowFrom,
storeAllowFrom,
dmPolicy,
});
// Group sender checks are explicit and must not inherit DM pairing-store entries.
const effectiveGroupAllow = normalizeAllowFrom(groupAllowOverride ?? groupAllowFrom);
const hasGroupAllowOverride = typeof groupAllowOverride !== "undefined";
const senderId = msg.from?.id ? String(msg.from.id) : "";
const senderUsername = msg.from?.username ?? "";