nyrn
/
openclaw
mirror of https://github.com/openclaw/openclaw.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix(security): escape backticks in exec-approval command previews (#20854) 

Command text displayed in Discord exec-approval embeds was not sanitized,
allowing crafted commands containing backticks to break out of the markdown
code block and inject arbitrary Discord formatting. This fix inserts a
zero-width space before each backtick to neutralize markdown injection.
This commit is contained in:
David Rudduck 2026-02-19 21:17:06 +10:00 committed by GitHub
parent f1e1ad73ad
commit ee6d0bd321
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/discord/monitor/exec-approvals.ts
View File

@ -230,8 +230,8 @@ function createExecApprovalRequestContainer(params: {
actionRow?: Row<Button>;
}): ExecApprovalContainer {
const commandText = params.request.request.command;
const commandPreview =
commandText.length > 1000 ? `${commandText.slice(0, 1000)}...` : commandText;
const commandRaw = commandText.length > 1000 ? `${commandText.slice(0, 1000)}...` : commandText;
const commandPreview = commandRaw.replace(/`/g, "\u200b`");
const expiresAtSeconds = Math.max(0, Math.floor(params.request.expiresAtMs / 1000));
return new ExecApprovalContainer({
@ -255,7 +255,8 @@ function createResolvedContainer(params: {
accountId: string;
}): ExecApprovalContainer {
const commandText = params.request.request.command;
const commandPreview = commandText.length > 500 ? `${commandText.slice(0, 500)}...` : commandText;
const commandRaw = commandText.length > 500 ? `${commandText.slice(0, 500)}...` : commandText;
const commandPreview = commandRaw.replace(/`/g, "\u200b`");
const decisionLabel =
params.decision === "allow-once"
@ -288,7 +289,8 @@ function createExpiredContainer(params: {
accountId: string;
}): ExecApprovalContainer {
const commandText = params.request.request.command;
const commandPreview = commandText.length > 500 ? `${commandText.slice(0, 500)}...` : commandText;
const commandRaw = commandText.length > 500 ? `${commandText.slice(0, 500)}...` : commandText;
const commandPreview = commandRaw.replace(/`/g, "\u200b`");
return new ExecApprovalContainer({
cfg: params.cfg,