14fe739ee9
fix(feishu): enforce exact signed webhook request boundaries ( #118758 )
...
* fix(feishu): enforce exact signed webhook request targets
* fix(feishu): preserve explicitly configured signed webhook query targets
* fix(feishu): preserve shipped relative webhook paths
* fix(feishu): normalize and migrate legacy webhook callback paths
* fix(feishu): preserve transformed webhook schema defaults
* fix(feishu): require canonical webhook paths before runtime startup
* docs(feishu): document canonical webhook routes and doctor recovery
2026-08-03 14:52:58 -07:00
c40a9b15b0
fix(feishu): guard Object.assign against prototype pollution in webhook payload merge ( #111729 )
...
* fix(feishu): guard Object.assign against prototype pollution in webhook payload merge
Object.assign merges JSON.parse webhook payload into an Object.create target
without filtering `__proto__`, `constructor`, or `prototype` keys. A
crafted webhook body like `{"__proto__": {"polluted": true}}` would set
the `__proto__` property on the envelope object, enabling prototype
pollution on the target.
Replace Object.assign with explicit iteration that skips blocked keys, and
use Object.create(null) so the envelope itself has no prototype to pollute.
Matches the isBlockedObjectKey pattern used in core config paths.
* fix(feishu): preserve webhook envelope when filtering payloads
* fix(feishu): preserve webhook envelope when filtering payloads
---------
Co-authored-by: Vincent Koc <vincentkoc@ieee.org >
2026-07-30 01:27:55 +08:00
601a405430
fix(channels): mark durable webhook acceptance on Zalo, Google Chat, SMS, Feishu, Nextcloud Talk, and Synology Chat ( #115586 )
...
* fix(channels): extend the durable-acceptance marker to zalo, googlechat, and sms
* fix(feishu): mark durable webhook acceptance
* fix(channels): extend the durable-acceptance marker to nextcloud-talk and synology-chat
* fix(channels): extend the durable-acceptance marker to zalo, googlechat, and sms
* fix(feishu): mark durable webhook acceptance
* fix(channels): extend the durable-acceptance marker to nextcloud-talk and synology-chat
* fix(channels): carry durable webhook admission results
* docs(changelog): note durable webhook acceptance
* test(channels): tighten webhook admission types
* chore: leave release changelog to release prep
---------
Co-authored-by: Vincent Koc <vincentkoc@ieee.org >
2026-07-30 01:07:08 +08:00
8b1d0278f4
fix(feishu): decouple bot identity from AI registration
2026-07-22 20:13:12 -05:00
eb60b2208c
refactor(feishu): remove unused exports
2026-07-13 12:44:33 -07:00
81941f2d68
test: enable noUncheckedIndexedAccess for extension tests ( #105343 )
2026-07-12 12:48:22 +01:00
e4f448c74f
fix(feishu): suppress log noise for bot_p2p_chat_entered_v1 event [AI-assisted] ( #93574 )
...
Merged via squash.
Prepared head SHA: 598af62d5b72104254+eldar702@users.noreply.github.com >
Co-authored-by: vincentkoc <25068+vincentkoc@users.noreply.github.com >
Reviewed-by: @vincentkoc
2026-06-16 18:47:31 +08:00
9f32bea397
fix(feishu): await HTTP server shutdown during monitor cleanup
...
Source PR: https://github.com/openclaw/openclaw/pull/48588
Co-authored-by: alex sagit <267811734+alex-xuweilong@users.noreply.github.com >
2026-06-14 10:56:15 +08:00
58912f8fd8
docs: document channel extension sources
2026-06-04 21:59:00 -04:00
aab5410bd5
test: speed up slow test suite ( #87611 )
...
* test: speed up slow test suite
* test: preserve fake timer cleanup hooks
* test: avoid timeout readiness race
* test: satisfy reply test types
* test: restore runner and image coverage
* test: restore final media runner path
* test: make cli auth status fixture deterministic
* test: repair runtime alias fixtures
2026-05-28 13:20:19 +01:00
1ef85c7d4c
test: make suites safe without isolation ( #78834 )
...
* test: make suites safe without isolation
* fix: narrow auth profile credential types
* test: inject channel module loader factory locally
2026-05-07 08:43:29 +01:00
5e8cb22176
Feishu: validate webhook signatures before parsing ( #55083 )
...
* Feishu: validate webhook signatures before parsing
* Scripts: allow Feishu raw body guard callsite
2026-03-26 10:29:22 +00:00
223ae42c79
fix(feishu): harden webhook signature compare
2026-03-16 22:22:30 -07:00
b213348665
test: dedupe feishu signed webhook posts
2026-03-13 23:35:26 +00:00
6464149031
refactor: share feishu webhook monitor harness
2026-03-13 18:38:12 +00:00
496ca3a637
fix(feishu): fail closed on webhook signature checks
2026-03-13 03:13:56 +00:00
Peter Steinberger