let5see/clawdbot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): gate slash/control commands

Browse Source
This commit is contained in:
Peter Steinberger
2026-01-17 06:49:17 +00:00
parent 7ed55682b7
commit 6a3ed5c850
22 changed files with 758 additions and 203 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
src/signal/monitor/event-handler.ts
View File

@@ -31,6 +31,7 @@ import {
} from "../../pairing/pairing-store.js";
import { resolveAgentRoute } from "../../routing/resolve-route.js";
import { normalizeE164 } from "../../utils.js";
import { resolveCommandAuthorizedFromAuthorizers } from "../../channels/command-gating.js";
import {
formatSignalPairingIdLine,
formatSignalSenderDisplay,
@@ -400,11 +401,22 @@ export function createSignalEventHandler(deps: SignalEventHandlerDeps) {
}
}
const useAccessGroups = deps.cfg.commands?.useAccessGroups !== false;
const ownerAllowedForCommands = isSignalSenderAllowed(sender, effectiveDmAllow);
const groupAllowedForCommands = isSignalSenderAllowed(sender, effectiveGroupAllow);
const commandAuthorized = isGroup
? effectiveGroupAllow.length > 0
? isSignalSenderAllowed(sender, effectiveGroupAllow)
: true
? resolveCommandAuthorizedFromAuthorizers({
useAccessGroups,
authorizers: [
{ configured: effectiveDmAllow.length > 0, allowed: ownerAllowedForCommands },
{ configured: effectiveGroupAllow.length > 0, allowed: groupAllowedForCommands },
],
})
: dmAllowed;
if (isGroup && hasControlCommand(messageText, deps.cfg) && !commandAuthorized) {
logVerbose(`signal: drop control command from unauthorized sender ${senderDisplay}`);
return;
}
let mediaPath: string | undefined;
let mediaType: string | undefined;