Harden Feishu webhook replay guards#66707
Merged
Merged
Conversation
openclaw-barnacle
Bot
added
channel: feishu
Contributor
Greptile SummaryHardens three Feishu security guards to fail closed: Confidence Score: 5/5
Prompt To Fix All With AIThis is a comment left during a code review.
Path: extensions/feishu/src/card-action.ts
Line: 186-192
Comment:
**Blank-token guard placed after `decodeFeishuCardAction` call**
The early-return guard for a missing token is inserted after `decodeFeishuCardAction({ event })` runs on line 186. Since decoding is pure/side-effect-free this isn't a correctness issue, but moving the check above the `decoded` declaration is slightly cheaper and makes the "fail fast" intent clearer to readers.
```suggestion
const { cfg, event, runtime, accountId } = params;
const account = resolveFeishuRuntimeAccount({ cfg, accountId });
const log = runtime?.log ?? console.log;
if (!event.token.trim()) {
log(
`feishu[${account.accountId}]: rejected card action from ${event.operator.open_id}: missing token`,
);
return;
}
const decoded = decodeFeishuCardAction({ event });
```
How can I resolve this? If you propose a fix, please make it concise.Reviews (1): Last reviewed commit: "fix(feishu): harden webhook replay guard..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Run the early-return guard against a missing/blank card-action token before decoding the card-action payload. Decoding is side-effect-free so this is a readability + tiny-perf nit, not a correctness change. Matches Greptile's P2 suggestion.
kvnkho
pushed a commit
to kvnkho/openclaw
that referenced
this pull request
Apr 17, 2026
* fix(feishu): harden webhook replay guards * changelog: note Feishu webhook + card-action fail-closed hardening (openclaw#66707) * fix(feishu): move blank-token check above decodeFeishuCardAction Run the early-return guard against a missing/blank card-action token before decoding the card-action payload. Decoding is side-effect-free so this is a readability + tiny-perf nit, not a correctness change. Matches Greptile's P2 suggestion. --------- Co-authored-by: Devin Robison <[email protected]>
lovewanwan
pushed a commit
to lovewanwan/openclaw
that referenced
this pull request
Apr 28, 2026
* fix(feishu): harden webhook replay guards * changelog: note Feishu webhook + card-action fail-closed hardening (openclaw#66707) * fix(feishu): move blank-token check above decodeFeishuCardAction Run the early-return guard against a missing/blank card-action token before decoding the card-action payload. Decoding is side-effect-free so this is a readability + tiny-perf nit, not a correctness change. Matches Greptile's P2 suggestion. --------- Co-authored-by: Devin Robison <[email protected]>
25 tasks
ogt-redknie
pushed a commit
to ogt-redknie/OPENX
that referenced
this pull request
May 2, 2026
* fix(feishu): harden webhook replay guards * changelog: note Feishu webhook + card-action fail-closed hardening (openclaw#66707) * fix(feishu): move blank-token check above decodeFeishuCardAction Run the early-return guard against a missing/blank card-action token before decoding the card-action payload. Decoding is side-effect-free so this is a readability + tiny-perf nit, not a correctness change. Matches Greptile's P2 suggestion. --------- Co-authored-by: Devin Robison <[email protected]>
github-actions Bot
pushed a commit
to Desicool/openclaw
that referenced
this pull request
May 9, 2026
* fix(feishu): harden webhook replay guards * changelog: note Feishu webhook + card-action fail-closed hardening (openclaw#66707) * fix(feishu): move blank-token check above decodeFeishuCardAction Run the early-return guard against a missing/blank card-action token before decoding the card-action payload. Decoding is side-effect-free so this is a readability + tiny-perf nit, not a correctness change. Matches Greptile's P2 suggestion. --------- Co-authored-by: Devin Robison <[email protected]>
globalcaos
pushed a commit
to globalcaos/tinkerclaw
that referenced
this pull request
May 13, 2026
* fix(feishu): harden webhook replay guards * changelog: note Feishu webhook + card-action fail-closed hardening (openclaw#66707) * fix(feishu): move blank-token check above decodeFeishuCardAction Run the early-return guard against a missing/blank card-action token before decoding the card-action payload. Decoding is side-effect-free so this is a readability + tiny-perf nit, not a correctness change. Matches Greptile's P2 suggestion. --------- Co-authored-by: Devin Robison <[email protected]>
github-actions Bot
pushed a commit
to Desicool/openclaw
that referenced
this pull request
May 24, 2026
* fix(feishu): harden webhook replay guards * changelog: note Feishu webhook + card-action fail-closed hardening (openclaw#66707) * fix(feishu): move blank-token check above decodeFeishuCardAction Run the early-return guard against a missing/blank card-action token before decoding the card-action payload. Decoding is side-effect-free so this is a readability + tiny-perf nit, not a correctness change. Matches Greptile's P2 suggestion. --------- Co-authored-by: Devin Robison <[email protected]>
jameslcowan
pushed a commit
to jameslcowan/openclaw
that referenced
this pull request
Jun 2, 2026
* fix(feishu): harden webhook replay guards * changelog: note Feishu webhook + card-action fail-closed hardening (openclaw#66707) * fix(feishu): move blank-token check above decodeFeishuCardAction Run the early-return guard against a missing/blank card-action token before decoding the card-action payload. Decoding is side-effect-free so this is a readability + tiny-perf nit, not a correctness change. Matches Greptile's P2 suggestion. --------- Co-authored-by: Devin Robison <[email protected]>
This was referenced Jun 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Changes
monitorWebhookreject startup without anencryptKeyand fail closed in signature validation when no key is presenthandleFeishuCardActionand stop treating them as fresh dedupe claimsValidation
pnpm test extensions/feishu/src/bot.card-action.test.ts extensions/feishu/src/monitor.webhook-security.test.ts extensions/feishu/src/monitor.card-action.lifecycle.test.tspnpm tsgoand confirmed the remaining failures are unrelated existing issues inextensions/telegram/src/bot-handlers.runtime.ts:840andsrc/infra/outbound/message-action-runner.media.test.ts:651claude -p "/review", but it hung in this environment without producing outputNotes