Reply: fix generated image delivery to Discord#52489
Merged
scoootscooob merged 1 commit intoopenclaw:mainfrom Mar 22, 2026
Merged
Reply: fix generated image delivery to Discord#52489scoootscooob merged 1 commit intoopenclaw:mainfrom
scoootscooob merged 1 commit intoopenclaw:mainfrom
Conversation
🔒 Aisle Security AnalysisWe found 1 potential security issue(s) in this PR:
1. 🔵 OpenAI image provider accepts arbitrary
|
| Property | Value |
|---|---|
| Severity | Low |
| CWE | CWE-20 |
| Location | src/image-generation/providers/openai.ts:34-38 |
Description
The OpenAI image-generation provider returns a caller-supplied size string directly (only trimmed) and forwards it to the OpenAI API request body.
req.sizecan originate from higher-level runtime/tool inputs.- The provider advertises
OPENAI_SUPPORTED_SIZESin capabilities metadata, but does not enforce that the runtime request uses one of these allowed presets. - This can lead to:
- unexpected provider behavior / API errors (reliability impact)
- bypass of intended geometry/cost controls if upstream validation is skipped or another caller uses the runtime directly
- potential resource issues if an extremely large
sizestring is provided (oversized request/log payloads)
Vulnerable code:
const explicitSize = params.size?.trim();
if (explicitSize) {
return explicitSize;
}Recommendation
Enforce provider geometry server-side before sending requests to OpenAI.
Option A (strict): reject unsupported sizes.
const OPENAI_SUPPORTED_SIZES = ["1024x1024", "1024x1536", "1536x1024"] as const;
const OPENAI_SUPPORTED_SIZE_SET = new Set<string>(OPENAI_SUPPORTED_SIZES);
function resolveOpenAISize(params: { size?: string; aspectRatio?: string }): string {
const explicitSize = params.size?.trim();
if (explicitSize) {
if (!OPENAI_SUPPORTED_SIZE_SET.has(explicitSize)) {
throw new Error(
`OpenAI image size must be one of ${OPENAI_SUPPORTED_SIZES.join(", ")}`,
);
}
return explicitSize;
}
// existing aspectRatio mapping...
}Option B (lenient): if unsupported, ignore and fall back to aspectRatio/default (but consider logging a warning).
Also consider adding a reasonable max length check (e.g. explicitSize.length <= 32) to prevent oversized payloads.
Analyzed PR: #52489 at commit 604a0f5
Last updated on: 2026-03-22T23:28:41Z
openclaw-barnacle
bot
added
channel: discord
scoootscooob
force-pushed
the
codex/discord-image-reply-fixes
branch
from
1838119 to
604a0f5
Compare
Contributor
Greptile SummaryThis PR fixes a three-part bug chain that caused Discord image attachments to be silently dropped: the Key changes
Minor observations
Confidence Score: 4/5
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Comment on lines
+9
to
+20
| const OPENAI_SUPPORTED_ASPECT_RATIOS = [ | ||
| "1:1", | ||
| "2:3", | ||
| "3:2", | ||
| "3:4", | ||
| "4:3", | ||
| "4:5", | ||
| "5:4", | ||
| "9:16", | ||
| "16:9", | ||
| "21:9", | ||
| ] as const; |
Contributor
There was a problem hiding this comment.
OPENAI_SUPPORTED_ASPECT_RATIOS is advertised to callers (via capabilities.geometry.aspectRatios) as ratios the provider "supports," but several entries are pure approximations. For example, "21:9" (~2.33:1) maps to 1536x1024 (~1.5:1), and "4:3" maps to the same 1536x1024 (3:2). Callers that trust the list to contain exact matches may be surprised.
A comment on the constant (or in resolveOpenAISize) explaining that these are best-effort mappings to the three available size presets would prevent future confusion:
// These are best-effort mappings to OpenAI's three supported size presets
// (1024x1024, 1024x1536, 1536x1024). Ratios like "21:9" or "4:3" are
// approximated to the nearest available size.
const OPENAI_SUPPORTED_ASPECT_RATIOS = [Prompt To Fix With AI
This is a comment left during a code review.
Path: src/image-generation/providers/openai.ts
Line: 9-20
Comment:
**Aspect-ratio list claims coverage OpenAI doesn't support natively**
`OPENAI_SUPPORTED_ASPECT_RATIOS` is advertised to callers (via `capabilities.geometry.aspectRatios`) as ratios the provider "supports," but several entries are pure approximations. For example, `"21:9"` (~2.33:1) maps to `1536x1024` (~1.5:1), and `"4:3"` maps to the same `1536x1024` (3:2). Callers that trust the list to contain exact matches may be surprised.
A comment on the constant (or in `resolveOpenAISize`) explaining that these are best-effort mappings to the three available size presets would prevent future confusion:
```typescript
// These are best-effort mappings to OpenAI's three supported size presets
// (1024x1024, 1024x1536, 1536x1024). Ratios like "21:9" or "4:3" are
// approximated to the nearest available size.
const OPENAI_SUPPORTED_ASPECT_RATIOS = [
```
How can I resolve this? If you propose a fix, please make it concise.
jacobtomlinson
pushed a commit
to jacobtomlinson/openclaw
that referenced
this pull request
Mar 22, 2026
frankekn
pushed a commit
to artwalker/openclaw
that referenced
this pull request
Mar 23, 2026
furaul
pushed a commit
to furaul/openclaw
that referenced
this pull request
Mar 24, 2026
alexey-pelykh
pushed a commit
to remoteclaw/remoteclaw
that referenced
this pull request
Mar 28, 2026
(cherry picked from commit 24032dc) # Conflicts: # extensions/discord/src/send.sends-basic-channel-messages.test.ts # extensions/discord/src/send.shared.ts # src/agents/tools/discord-actions.test.ts # src/agents/tools/image-generate-tool.test.ts # src/image-generation/providers/openai.test.ts # src/image-generation/providers/openai.ts
alexey-pelykh
pushed a commit
to remoteclaw/remoteclaw
that referenced
this pull request
Mar 28, 2026
(cherry picked from commit 24032dc) # Conflicts: # src/agents/tools/image-generate-tool.test.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Change Type (select all)
Scope (select all touched areas)
Linked Issue/PR
User-visible / Behavior Changes
image_generaterequests no longer fail when the agent chooses a supported aspect ratio.Security Impact (required)
No)No)No)No)No)Yes, explain risk + mitigation:Repro + Verification
Environment
anthropic/claude-sonnet-4-6withopenai/gpt-image-1.5Steps
image_generatesucceed in the session transcript withdetails.media.mediaUrlspopulated.Expected
Actual
Evidence
Attach at least one:
Human Verification (required)
What you personally verified (not just CI), and how:
image_generatesucceeded and stored a PNG path underdetails.media.mediaUrlsReview Conversations
If a bot review conversation is addressed by this PR, resolve that conversation yourself. Do not leave bot review conversation cleanup for maintainers.
Compatibility / Migration
Yes)No)No)Failure Recovery (if this breaks)
1838119db6778022b0e06ae480f1fae56bd41808Risks and Mitigations
sizestill wins, and coverage was added for aspect-ratio mapping behavior.Notes
pnpm buildpassed.pnpm test -- src/auto-reply/reply/reply-delivery.test.tspnpm test -- src/auto-reply/reply/dispatch-from-config.test.ts -t "suppresses group tool summaries but still forwards tool media"pnpm checkis currently blocked by unrelated existing TypeScript failures in untouched files:src/cron/service.issue-regressions.test-helpers.tssrc/cron/service.issue-regressions.test.ts