mirror of
https://github.com/openclaw/openclaw.git
synced 2026-07-06 06:43:34 +00:00
ff58d23e8f
* fix(telegram): resolve local Bot API container file paths against trustedLocalFileRoots When the self-hosted telegram-bot-api server runs with --local inside a container, getFile returns absolute file_path values rooted at the container data dir (/var/lib/telegram-bot-api/...). The host process mounts that volume at a different path, so the absolute path never matches a trustedLocalFileRoots entry and inbound media fails to materialize (messages reach the agent as bare <media:document> placeholders without bytes). Map container-absolute paths back to relative candidates and resolve them under each trusted root, trying both with and without the per-token directory segment the local server uses. Relative file_path values are now also resolved against trusted roots before falling back to the HTTP file endpoint, which keeps large-file (>20MB) local-mode downloads working. Path traversal protections: candidates are normalized, NUL bytes and dot-segments are rejected, and reads stay behind the trusted-roots file-access sandbox. AI-assisted (Claude Code), validated with targeted vitest run. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Co-Authored-By: Dizesales <269209351+Dizesales@users.noreply.github.com> * fix(telegram): map local Bot API container media paths Co-authored-by: Lucas Magalhaes <ellucasrj@gmail.com> * chore(config): refresh channel metadata --------- Co-authored-by: Lucas Magalhaes <ellucasrj@gmail.com> Co-authored-by: Dizesales <269209351+Dizesales@users.noreply.github.com> Co-authored-by: Peter Steinberger <steipete@gmail.com>