mirror of https://github.com/openclaw/openclaw.git
1055e71c4b
* fix(telegram): auto-wrap file references with TLD extensions to prevent URL previews Telegram's auto-linker aggressively treats filenames like HEARTBEAT.md, README.md, main.go, script.py as URLs and generates domain registrar previews. This fix adds comprehensive protection for file extensions that share TLDs: - High priority: .md, .go, .py, .pl, .ai, .sh - Medium priority: .io, .tv, .fm, .am, .at, .be, .cc, .co Implementation: - Added wrapFileReferencesInHtml() in format.ts - Runs AFTER markdown→HTML conversion - Tokenizes HTML to respect tag boundaries - Skips content inside <code>, <pre>, <a> tags (no nesting issues) - Applied to all rendering paths: renderTelegramHtmlText, markdownToTelegramHtml, markdownToTelegramChunks, and delivery.ts fallback Addresses review comments: - P1: Now handles chunked rendering paths correctly - P2: No longer wraps inside existing code blocks (token-based parsing) - No lookbehinds used (broad Node compatibility) Includes comprehensive test suite in format.wrap-md.test.ts AI-assisted: true * fix(telegram): prevent URL previews for file refs with TLD extensions Two layers were causing spurious link previews for file references like `README.md`, `backup.sh`, `main.go`: 1. **markdown-it linkify** converts `README.md` to `<a href="http://README.md">README.md</a>` (.md = Moldova TLD) 2. **Telegram auto-linker** treats remaining bare text as URLs ## Changes ### Primary fix: suppress auto-linkified file refs in buildTelegramLink - Added `isAutoLinkedFileRef()` helper that detects when linkify auto- generated a link from a bare filename (href = "http://" + label) - Rejects paths with domain-like segments (dots in non-final path parts) - Modified `buildTelegramLink()` to return null for these, so file refs stay as plain text and get wrapped in `<code>` by the wrapper ### Safety-net: de-linkify in wrapFileReferencesInHtml - Added pre-pass that catches auto-linkified anchors in pre-rendered HTML - Handles edge cases where HTML is passed directly (textMode: "html") - Reuses `isAutoLinkedFileRef()` logic — no duplication ### Bug fixes discovered during review - **Fixed `isClosing` bug (line 169)**: the check `match[1] === "/"` was wrong — the regex `(<\/?)}` captures `<` or `</`, so closing tags were never detected. Changed to `match[1] === "</"`. This was causing `inCode/inPre/inAnchor` to stay stuck at true after any opening tag, breaking file ref wrapping after closing tags. - **Removed double `wrapFileReferencesInHtml` call**: `renderTelegramHtmlText` was calling `markdownToTelegramHtml` (which wraps) then wrapping again. ### Test coverage (+12 tests, 26 total) - `.sh` filenames (original issue #6932 mentioned backup.sh) - Auto-linkified anchor replacement - Auto-linkified path anchor replacement - Explicit link preservation (different label) - File ref after closing anchor tag (exercises isClosing fix) - Multiple file types in single message - Real URL preservation - Explicit markdown link preservation - File ref after real URL in same message - Chunked output file ref wrapping Closes #6932 * test(telegram): add comprehensive edge case coverage for file ref wrapping Add 16 edge case tests covering: - File refs inside bold/italic tags - Fenced code blocks (no double-wrap) - Domain-like paths preserved as links (example.com/README.md) - GitHub URLs with file paths - wrapFileRefs: false behavior - All TLD extensions (.ai, .io, .tv, .fm) - Non-TLD extensions not wrapped (.png, .css, .js) - File ref position (start, end, multiple in sequence) - Nested paths without domain segments - Version-like paths (v1.0/README.md wraps, example.com/v1.0/README.md links) - Hyphens and underscores in filenames - Uppercase extensions * fix(telegram): use regex literal and depth counters for tag tracking Code review fixes: 1. Replace RegExp constructor with regex literal for autoLinkedAnchor - Avoids double-escaping issues with \s - Uses backreference \1 to match href=label pattern directly 2. Replace boolean toggles with depth counters for tag nesting - codeDepth, preDepth, anchorDepth track nesting levels - Correctly handles nested tags like <pre><code>...</code></pre> - Prevents wrapping inside any level of protected tags Add 4 tests for edge cases: - Nested code tags (depth tracking) - Multiple anchor tags in sequence - Auto-linked anchor with backreference match - Anchor with different href/label (no match) * fix(telegram): add escapeHtml and escapeRegex for defense in depth Code review fixes: 1. Escape filename with escapeHtml() before inserting into <code> tags - Prevents HTML injection if regex ever matches unsafe chars - Defense in depth (current regex already limits to safe chars) 2. Escape extensions with escapeRegex() before joining into pattern - Prevents regex breakage if extensions contain metacharacters - Future-proofs against extensions like 'c++' or 'd.ts' Add tests documenting regex safety boundaries: - Filenames with special chars (&, <, >) don't match - Only [a-zA-Z0-9_.\-./] chars are captured * fix(telegram): catch orphaned single-letter TLD patterns When text like 'R&D.md' doesn't match the main file pattern (because & breaks the character class), the 'D.md' part can still be auto-linked by Telegram as a domain (https://d.md/). Add second pass to catch orphaned TLD patterns like 'D.md', 'R.io', 'X.ai' that follow non-alphanumeric characters and wrap them in <code> tags. Pattern: ([^a-zA-Z0-9]|^)([A-Za-z]\.(?:extensions))(?=[^a-zA-Z0-9/]|$) Tests added: - 'wraps orphaned TLD pattern after special character' (R&D.md → R&<code>D.md</code>) - 'wraps orphaned single-letter TLD patterns' (X.ai, R.io) * refactor(telegram): remove popular domain TLDs from file extension list Remove .ai, .io, .tv, .fm from FILE_EXTENSIONS_WITH_TLD because: - These are commonly used as real domains (x.ai, vercel.io, github.io) - Rarely used as actual file extensions - Users are more likely referring to websites than files Keep: md, sh, py, go, pl (common file extensions, rarely intentional domains) Keep: am, at, be, cc, co (less common as intentional domain references) Update tests to reflect the change: - Add test for supported extensions (.am, .at, .be, .cc, .co) - Add test verifying popular TLDs stay as links * fix(telegram): prevent orphaned TLD wrapping inside HTML tags Code review fixes: 1. Orphaned TLD pass now checks if match is inside HTML tag - Uses lastIndexOf('<') vs lastIndexOf('>') to detect tag context - Skips wrapping when between < and > (inside attributes) - Prevents invalid HTML like <a href="...&<code>D.md</code>"> 2. textMode: 'html' now trusts caller markup - Returns text unchanged instead of wrapping - Caller owns HTML structure in this mode Tests added: - 'does not wrap orphaned TLD inside href attributes' - 'does not wrap orphaned TLD inside any HTML attribute' - 'does not wrap in HTML mode (trusts caller markup)' * refactor(telegram): use snapshot for orphaned TLD offset clarity Use explicit snapshot variable when checking tag positions in orphaned TLD pass. While JavaScript's replace() doesn't mutate during iteration, this makes intent explicit and adds test coverage for multi-TLD HTML. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(telegram): prevent orphaned TLD wrapping inside code/pre tags - Add depth tracking for code/pre tags in orphaned TLD pass - Fix test to expect valid HTML output - 55 tests now covering nested tag scenarios Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(telegram): clamp depth counters and add anchor tracking to orphaned pass - Clamp depth counters at 0 for malformed HTML with stray closing tags - Add anchor depth tracking to orphaned TLD pass to prevent wrapping inside link text (e.g., <a href="...">R&D.md</a>) - 57 tests covering all edge cases Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(telegram): keep .co domains linked and wrap punctuated file refs --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Peter Steinberger <steipete@gmail.com> |
||
|---|---|---|
| .. | ||
| bot | ||
| accounts.test.ts | ||
| accounts.ts | ||
| allowed-updates.ts | ||
| api-logging.ts | ||
| audit.test.ts | ||
| audit.ts | ||
| bot-access.ts | ||
| bot-handlers.ts | ||
| bot-message-context.dm-threads.test.ts | ||
| bot-message-context.dm-topic-threadid.test.ts | ||
| bot-message-context.sender-prefix.test.ts | ||
| bot-message-context.ts | ||
| bot-message-dispatch.test.ts | ||
| bot-message-dispatch.ts | ||
| bot-message.test.ts | ||
| bot-message.ts | ||
| bot-native-commands.plugin-auth.test.ts | ||
| bot-native-commands.test.ts | ||
| bot-native-commands.ts | ||
| bot-updates.ts | ||
| bot.create-telegram-bot.accepts-group-messages-mentionpatterns-match-without-botusername.test.ts | ||
| bot.create-telegram-bot.applies-topic-skill-filters-system-prompts.test.ts | ||
| bot.create-telegram-bot.blocks-all-group-messages-grouppolicy-is.test.ts | ||
| bot.create-telegram-bot.dedupes-duplicate-callback-query-updates-by-update.test.ts | ||
| bot.create-telegram-bot.installs-grammy-throttler.test.ts | ||
| bot.create-telegram-bot.matches-tg-prefixed-allowfrom-entries-case-insensitively.test.ts | ||
| bot.create-telegram-bot.matches-usernames-case-insensitively-grouppolicy-is.test.ts | ||
| bot.create-telegram-bot.routes-dms-by-telegram-accountid-binding.test.ts | ||
| bot.create-telegram-bot.sends-replies-without-native-reply-threading.test.ts | ||
| bot.media.downloads-media-file-path-no-file-download.e2e.test.ts | ||
| bot.media.includes-location-text-ctx-fields-pins.e2e.test.ts | ||
| bot.test.ts | ||
| bot.ts | ||
| caption.ts | ||
| download.test.ts | ||
| download.ts | ||
| draft-chunking.test.ts | ||
| draft-chunking.ts | ||
| draft-stream.test.ts | ||
| draft-stream.ts | ||
| fetch.test.ts | ||
| fetch.ts | ||
| format.test.ts | ||
| format.ts | ||
| format.wrap-md.test.ts | ||
| group-migration.test.ts | ||
| group-migration.ts | ||
| index.ts | ||
| inline-buttons.test.ts | ||
| inline-buttons.ts | ||
| model-buttons.test.ts | ||
| model-buttons.ts | ||
| monitor.test.ts | ||
| monitor.ts | ||
| network-config.test.ts | ||
| network-config.ts | ||
| network-errors.test.ts | ||
| network-errors.ts | ||
| probe.test.ts | ||
| probe.ts | ||
| proxy.test.ts | ||
| proxy.ts | ||
| reaction-level.test.ts | ||
| reaction-level.ts | ||
| send.caption-split.test.ts | ||
| send.edit-message.test.ts | ||
| send.preserves-thread-params-plain-text-fallback.test.ts | ||
| send.proxy.test.ts | ||
| send.returns-undefined-empty-input.test.ts | ||
| send.ts | ||
| send.video-note.test.ts | ||
| sent-message-cache.test.ts | ||
| sent-message-cache.ts | ||
| sticker-cache.test.ts | ||
| sticker-cache.ts | ||
| targets.test.ts | ||
| targets.ts | ||
| token.test.ts | ||
| token.ts | ||
| update-offset-store.test.ts | ||
| update-offset-store.ts | ||
| voice.test.ts | ||
| voice.ts | ||
| webhook-set.ts | ||
| webhook.test.ts | ||
| webhook.ts | ||