fix(feishu): propagate mediaLocalRoots for local file sends (#27884) by joelnishanth · Pull Request #27928 · openclaw/openclaw

joelnishanth · 2026-02-26T21:19:48Z

Summary

Fixes #27884 -- Feishu extension cannot send local files after CVE-2026-26321 security patch.

Root cause: After CVE-2026-26321, loadWebMedia requires explicit localRoots to allow reading local file paths. The Feishu outbound adapter was not propagating mediaLocalRoots from the ChannelOutboundContext through to sendMediaFeishu / loadWebMedia, so any local path was rejected with a path-not-allowed error.

Fix: Thread mediaLocalRoots from the outbound context through feishuOutbound.sendMedia into sendMediaFeishu, which passes it as localRoots to loadWebMedia. This matches the pattern already used by Telegram, Discord, Slack, Signal, iMessage, and WhatsApp adapters.

Changes

extensions/feishu/src/media.ts -- add mediaLocalRoots parameter to sendMediaFeishu; pass it as localRoots to loadWebMedia
extensions/feishu/src/outbound.ts -- destructure mediaLocalRoots from outbound context and forward to sendMediaFeishu
extensions/feishu/src/media.test.ts -- add regression test asserting mediaLocalRoots flows through as localRoots

Test plan

New test: "passes mediaLocalRoots as localRoots to loadWebMedia for local paths ([Feature]: feishu: Cannot send local files after CVE-2026-26321 security patch #27884)"
All 10 feishu media tests pass (pnpm test extensions/feishu/src/media.test.ts)
Remote URLs and buffer-based media paths are unaffected
When mediaLocalRoots is empty/undefined, falls back to default roots (fail-closed)

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d5be2c0ade

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-02-26T21:22:33Z

extensions/feishu/src/media.ts

    const loaded = await getFeishuRuntime().media.loadWebMedia(mediaUrl, {
      maxBytes: mediaMaxBytes,
      optimizeImages: false,
+      localRoots: mediaLocalRoots?.length ? mediaLocalRoots : undefined,


Preserve empty localRoots allowlist when forwarding roots

The new forwarding logic converts an explicitly empty mediaLocalRoots array into undefined, which changes caller intent from “deny all local paths” to “use default roots.” In loadWebMedia, undefined triggers getDefaultLocalRoots() while [] would reject all local paths, so a caller that passes mediaLocalRoots: [] (for strict lockdown) will now unexpectedly allow reads under default directories. This should pass mediaLocalRoots through unchanged so empty arrays remain fail-closed.

Useful? React with 👍 / 👎.

greptile-apps · 2026-02-26T21:22:54Z

Greptile Summary

Fixes #27884 by propagating mediaLocalRoots from the outbound context through to loadWebMedia, enabling local file sends after the CVE-2026-26321 security patch. The implementation follows the established pattern used by Telegram, Discord, Slack, Signal, iMessage, and WhatsApp adapters.

Key changes:

Threaded mediaLocalRoots parameter through feishuOutbound.sendMedia → sendMediaFeishu → loadWebMedia
Added regression test verifying mediaLocalRoots flows through as localRoots
Used defensive check (?.length) to ensure empty arrays fall back to default roots

The implementation is clean, well-tested, and consistent with security requirements.

Confidence Score: 5/5

This PR is safe to merge with minimal risk
The fix is straightforward and follows an established pattern used across multiple channel adapters in the codebase. The changes are minimal, focused, and include a regression test. The implementation correctly propagates the security-critical mediaLocalRoots parameter through the call chain to restore local file sending functionality after the CVE patch.
No files require special attention

_{Last reviewed commit: d5be2c0}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8554abf101

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-02-26T21:29:03Z

extensions/feishu/src/media.ts

    const loaded = await getFeishuRuntime().media.loadWebMedia(mediaUrl, {
      maxBytes: mediaMaxBytes,
      optimizeImages: false,
+      localRoots: mediaLocalRoots?.length ? mediaLocalRoots : undefined,


Honor empty mediaLocalRoots in loadWebMedia call

The new localRoots assignment treats an explicit empty allowlist as undefined (mediaLocalRoots?.length ? mediaLocalRoots : undefined), which changes behavior from “deny all local paths” to “use default roots.” In loadWebMedia/assertLocalMediaAllowed, undefined falls back to getDefaultLocalRoots() while [] would reject every local path, so callers that intentionally pass mediaLocalRoots: [] (fail-closed) now silently allow reads under default directories.

Useful? React with 👍 / 👎.

… sends (openclaw#27884)

Takhoffman · 2026-02-27T23:44:07Z

PR #27928 - fix(feishu): propagate mediaLocalRoots for local file sends (#27884) (#27928)

Merged via squash.

Merge commit: ad804b0
Verified: pnpm build, pnpm check, pnpm test:macmini
Changes made:
M CHANGELOG.md
Why these changes were made:
Add required changelog entry for the user-facing Feishu local media fix so autoland policy can merge.
Changelog: CHANGELOG.md updated=true required=true opt_out=false

Thanks @joelnishanth!

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]>

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]>

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]>

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]>

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]> (cherry picked from commit 6a83767)

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]> (cherry picked from commit 6a83767)

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]>

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]>

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]>

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]>

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]>

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]> (cherry picked from commit ad804b0) # Conflicts: # CHANGELOG.md # extensions/feishu/src/media.test.ts # extensions/feishu/src/media.ts # extensions/feishu/src/outbound.ts

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]>

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]>

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]>

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]>

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]>

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]>

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]>

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]> (cherry picked from commit ad804b0) # Conflicts: # CHANGELOG.md # extensions/feishu/src/media.test.ts # extensions/feishu/src/media.ts # extensions/feishu/src/outbound.ts

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]>

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]> (cherry picked from commit ad804b0)

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]>

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]>

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]> (cherry picked from commit ad804b0)

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth (#1449) Verified: - pnpm build - pnpm check - pnpm test:macmini (cherry picked from commit ad804b0) Co-authored-by: OfflynAI <[email protected]> Co-authored-by: Tak Hoffman <[email protected]>

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]> (cherry picked from commit ad804b0)

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]> (cherry picked from commit ad804b0)

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]> (cherry picked from commit ad804b0)

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]> (cherry picked from commit ad804b0)

@joelnishanth

…#27884) (openclaw#27928) thanks @joelnishanth Verified: - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: joelnishanth <[email protected]> Co-authored-by: Tak Hoffman <[email protected]> (cherry picked from commit ad804b0)

openclaw-barnacle bot added channel: feishu Channel integration: feishu size: XS labels Feb 26, 2026

chatgpt-codex-connector bot reviewed Feb 26, 2026

View reviewed changes

openclaw-barnacle bot added the agents Agent runtime and tooling label Feb 26, 2026

chatgpt-codex-connector bot reviewed Feb 26, 2026

View reviewed changes

openclaw-barnacle bot added app: macos App: macos size: S and removed size: XS labels Feb 26, 2026

joelnishanth and others added 2 commits February 27, 2026 17:28

fix(feishu): propagate mediaLocalRoots to loadWebMedia for local file…

22e017b

… sends (openclaw#27884)

chore: update changelog for openclaw#27928

ece162b

Takhoffman force-pushed the fix/feishu-local-media-roots branch from a6f64d5 to ece162b Compare February 27, 2026 23:43

openclaw-barnacle bot added size: XS and removed app: macos App: macos agents Agent runtime and tooling size: S labels Feb 27, 2026

Takhoffman merged commit ad804b0 into openclaw:main Feb 27, 2026
10 checks passed

github-actions bot mentioned this pull request Mar 1, 2026

cherry-pick: upstream docs commits (2026-03-01-0443) hughdidit/DAISy-Agency#141

Closed

6 tasks

alexey-pelykh mentioned this pull request Mar 10, 2026

Cherry-pick: Feishu adapter — community PRs and fixes remoteclaw/remoteclaw#678

Closed

alexey-pelykh mentioned this pull request Mar 15, 2026

Cherry-pick ad804b035: fix(feishu): propagate mediaLocalRoots for local file sends remoteclaw/remoteclaw#1449

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(feishu): propagate mediaLocalRoots for local file sends (#27884)#27928

fix(feishu): propagate mediaLocalRoots for local file sends (#27884)#27928
Takhoffman merged 2 commits intoopenclaw:mainfrom
joelnishanth:fix/feishu-local-media-roots

joelnishanth commented Feb 26, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Feb 26, 2026

Uh oh!

greptile-apps bot commented Feb 26, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Feb 26, 2026

Uh oh!

Uh oh!

Takhoffman commented Feb 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

joelnishanth commented Feb 26, 2026

Summary

Changes

Test plan

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot commented Feb 26, 2026

Greptile Summary

Confidence Score: 5/5

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Takhoffman commented Feb 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants