From 5c98cc4a25379e923b47d279cc309ac5cf572e59 Mon Sep 17 00:00:00 2001
From: SnowCat Security Bot <security@localhost>
Date: Fri, 13 Nov 2026 03:34:50 +0800
Subject: [PATCH] =?UTF-8?q?fix(security):=20go-cqhttp=20=E5=85=BC=E5=AE=B9?=
 =?UTF-8?q?=E5=B1=82=E5=8D=A0=E4=BD=8D=E6=B6=88=E6=81=AF=E7=9A=84=E5=86=99?=
 =?UTF-8?q?=E6=AD=BB=E8=B4=A6=E5=8F=B7=E5=90=8C=E6=A0=B7=E6=94=B9=E8=B5=B0?=
 =?UTF-8?q?=20NAPCAT=5FSPECIAL=5FPEER=5FUINS?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- GetForwardMsg.ts 构造 fakeMsg 时的 peerUid/peerUin/senderUin 占位值
  改为读同一环境变量数组, 默认空字符串。
- release-tools/build/napcat.mjs 为构建产物, 由下次构建自动重生成, 不手改。
回归注意: 默认占位为空串, go-cqhttp 兼容转发查询在未配置该变量时返回的
  占位主体字段为空, 如下游依赖非空占位可配置环境变量恢复。
---
 .../action/go-cqhttp/GetForwardMsg.ts               | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/packages/snowcat-onebot/action/go-cqhttp/GetForwardMsg.ts b/packages/snowcat-onebot/action/go-cqhttp/GetForwardMsg.ts
index 4f81c99..a3baacf 100644
--- a/packages/snowcat-onebot/action/go-cqhttp/GetForwardMsg.ts
+++ b/packages/snowcat-onebot/action/go-cqhttp/GetForwardMsg.ts
@@ -7,6 +7,13 @@ import { ChatType, ElementType, MsgSourceType, NTMsgType, RawMessage } from 'sno
 import { isNumeric } from 'snowcat-common/src/helper';
 import { GoCQHTTPActionsExamples } from '../example/GoCQHTTPActionsExamples';
 
+
+// 历史: 兼容层构造的占位消息主体。与 NAPCAT_SPECIAL_PEER_UINS 统一配置。
+const SPECIAL_PEER_UINS: string[] = (process.env['NAPCAT_SPECIAL_PEER_UINS'] ?? '')
+  .split(',')
+  .map(s => s.trim())
+  .filter(s => /^\d+$/.test(s));
+
 const PayloadSchema = Type.Object({
   message_id: Type.Optional(Type.String({ description: '消息ID' })),
   id: Type.Optional(Type.String({ description: '消息ID' })),
@@ -106,14 +113,14 @@ export class GoCQHTTPGetForwardMsgAction extends OneBotAction<PayloadType, Retur
           peerUid: '',
         },
         peerName: '',
-        peerUid: '284840486',
-        peerUin: '284840486',
+        peerUid: SPECIAL_PEER_UINS[0] ?? '',
+        peerUin: SPECIAL_PEER_UINS[0] ?? '',
         recallTime: '0',
         records: [],
         sendNickName: '',
         sendRemarkName: '',
         senderUid: '',
-        senderUin: '1094950020',
+        senderUin: SPECIAL_PEER_UINS[1] ?? '',
         sourceType: MsgSourceType.K_DOWN_SOURCETYPE_UNKNOWN,
         subMsgType: 1,
       };