github/openclaw
1
1
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-02-19 18:39:20 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): escape backticks in exec-approval command previews (#20854)

Browse Source 
Command text displayed in Discord exec-approval embeds was not sanitized,
allowing crafted commands containing backticks to break out of the markdown
code block and inject arbitrary Discord formatting. This fix inserts a
zero-width space before each backtick to neutralize markdown injection.
This commit is contained in:
David Rudduck
2026-02-19 21:17:06 +10:00
committed by GitHub
parent f1e1ad73ad
commit ee6d0bd321
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/discord/monitor/exec-approvals.ts
View File

@@ -230,8 +230,8 @@ function createExecApprovalRequestContainer(params: {
actionRow?: Row<Button>;
}): ExecApprovalContainer {
const commandText = params.request.request.command;
const commandPreview =
commandText.length > 1000 ? `${commandText.slice(0, 1000)}...` : commandText;
const commandRaw = commandText.length > 1000 ? `${commandText.slice(0, 1000)}...` : commandText;
const commandPreview = commandRaw.replace(/`/g, "\u200b`");
const expiresAtSeconds = Math.max(0, Math.floor(params.request.expiresAtMs / 1000));
return new ExecApprovalContainer({
@@ -255,7 +255,8 @@ function createResolvedContainer(params: {
accountId: string;
}): ExecApprovalContainer {
const commandText = params.request.request.command;
const commandPreview = commandText.length > 500 ? `${commandText.slice(0, 500)}...` : commandText;
const commandRaw = commandText.length > 500 ? `${commandText.slice(0, 500)}...` : commandText;
const commandPreview = commandRaw.replace(/`/g, "\u200b`");
const decisionLabel =
params.decision === "allow-once"
@@ -288,7 +289,8 @@ function createExpiredContainer(params: {
accountId: string;
}): ExecApprovalContainer {
const commandText = params.request.request.command;
const commandPreview = commandText.length > 500 ? `${commandText.slice(0, 500)}...` : commandText;
const commandRaw = commandText.length > 500 ? `${commandText.slice(0, 500)}...` : commandText;
const commandPreview = commandRaw.replace(/`/g, "\u200b`");
return new ExecApprovalContainer({
cfg: params.cfg,