github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-10 14:35:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

security(telegram): fail closed group allowlist against DM pairing store

Browse Source
This commit is contained in:
bmendonca3
2026-02-24 19:07:20 -07:00
committed by Ayaan Zaidi
parent 5500000492
commit c7352f6b3f
3 changed files with 36 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
src/telegram/bot.create-telegram-bot.test.ts
View File

@@ -1416,6 +1416,30 @@ describe("createTelegramBot", () => {
expect(replySpy.mock.calls.length, testCase.name).toBe(0);
}
});
it("blocks group sender not in groupAllowFrom even when sender is paired in DM store", async () => {
resetHarnessSpies();
loadConfig.mockReturnValue({
channels: {
telegram: {
groupPolicy: "allowlist",
groupAllowFrom: ["222222222"],
groups: { "*": { requireMention: false } },
},
},
});
readChannelAllowFromStore.mockResolvedValueOnce(["123456789"]);
await dispatchMessage({
message: {
chat: { id: -100123456789, type: "group", title: "Test Group" },
from: { id: 123456789, username: "testuser" },
text: "hello",
date: 1736380800,
},
});
expect(replySpy).not.toHaveBeenCalled();
});
it("allows control commands with TG-prefixed groupAllowFrom entries", async () => {
loadConfig.mockReturnValue({
channels: {