fix(security): go-cqhttp 兼容层占位消息的写死账号同样改走 NAPCAT_SPECIAL_PEER_UINS

- GetForwardMsg.ts 构造 fakeMsg 时的 peerUid/peerUin/senderUin 占位值
  改为读同一环境变量数组, 默认空字符串。
- release-tools/build/napcat.mjs 为构建产物, 由下次构建自动重生成, 不手改。
回归注意: 默认占位为空串, go-cqhttp 兼容转发查询在未配置该变量时返回的
  占位主体字段为空, 如下游依赖非空占位可配置环境变量恢复。
This commit is contained in:
SnowCat Security Bot committed 2026-11-13 03:34:50 +08:00
1 parent 148db8db87
commit 5c98cc4a25
1 file changed
+10 -3
@@ -7,6 +7,13 @@ import { ChatType, ElementType, MsgSourceType, NTMsgType, RawMessage } from 'sno
import { isNumeric } from 'snowcat-common/src/helper'; import { isNumeric } from 'snowcat-common/src/helper';
import { GoCQHTTPActionsExamples } from '../example/GoCQHTTPActionsExamples'; import { GoCQHTTPActionsExamples } from '../example/GoCQHTTPActionsExamples';
// 历史: 兼容层构造的占位消息主体。与 NAPCAT_SPECIAL_PEER_UINS 统一配置。
const SPECIAL_PEER_UINS: string[] = (process.env['NAPCAT_SPECIAL_PEER_UINS'] ?? '')
.split(',')
.map(s => s.trim())
.filter(s => /^\d+$/.test(s));
const PayloadSchema = Type.Object({ const PayloadSchema = Type.Object({
message_id: Type.Optional(Type.String({ description: '消息ID' })), message_id: Type.Optional(Type.String({ description: '消息ID' })),
id: Type.Optional(Type.String({ description: '消息ID' })), id: Type.Optional(Type.String({ description: '消息ID' })),
@@ -106,14 +113,14 @@ export class GoCQHTTPGetForwardMsgAction extends OneBotAction<PayloadType, Retur
peerUid: '', peerUid: '',
}, },
peerName: '', peerName: '',
peerUid: '284840486', peerUid: SPECIAL_PEER_UINS[0] ?? '',
peerUin: '284840486', peerUin: SPECIAL_PEER_UINS[0] ?? '',
recallTime: '0', recallTime: '0',
records: [], records: [],
sendNickName: '', sendNickName: '',
sendRemarkName: '', sendRemarkName: '',
senderUid: '', senderUid: '',
senderUin: '1094950020', senderUin: SPECIAL_PEER_UINS[1] ?? '',
sourceType: MsgSourceType.K_DOWN_SOURCETYPE_UNKNOWN, sourceType: MsgSourceType.K_DOWN_SOURCETYPE_UNKNOWN,
subMsgType: 1, subMsgType: 1,
}; };