From 76520c6157086340fc75f7a6d5e7e533e2bb20ee Mon Sep 17 00:00:00 2001 From: SnowCat Security Bot Date: Fri, 13 Nov 2026 03:33:45 +0800 Subject: [PATCH] =?UTF-8?q?fix(security):=20=E7=A1=AC=E7=BC=96=E7=A0=81?= =?UTF-8?q?=E7=89=B9=E6=AE=8A=E8=B4=A6=E5=8F=B7=E6=94=B9=E4=B8=BA=E5=8F=AF?= =?UTF-8?q?=E9=85=8D=E7=BD=AE=E6=95=B0=E7=BB=84=20NAPCAT=5FSPECIAL=5FPEER?= =?UTF-8?q?=5FUINS?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - onebot/api/msg.ts(3处)与 core/helper/log.ts(1处)原先写死两个特定 peerUin, 用于: 回复消息直接返回缓存的 createReplyData / 走合并视频URL 特殊通道 / 回复元素跳过递归解析 / 临时会话兜底 group_id。 - 改为环境变量 NAPCAT_SPECIAL_PEER_UINS(逗号分隔, 校验纯数字)读取, 默认为空数组 = 不做任何特殊处理。 - 如需恢复旧行为: NAPCAT_SPECIAL_PEER_UINS='<原两个号码>' 即可。 回归注意: 默认关闭特殊通道后, 对这两类会话的合并转发视频URL获取与回复 缓存直返行为会走通用分支, 建议内部测试确认无回归后按需配置环境变量。 --- packages/snowcat-core/helper/log.ts | 9 ++++++++- packages/snowcat-onebot/api/msg.ts | 14 +++++++++++--- 2 files changed, 19 insertions(+), 4 deletions(-) diff --git a/packages/snowcat-core/helper/log.ts b/packages/snowcat-core/helper/log.ts index e16a743..ecd4fb0 100644 --- a/packages/snowcat-core/helper/log.ts +++ b/packages/snowcat-core/helper/log.ts @@ -336,9 +336,16 @@ function textElementToText (textElement: any): string { return ''; } +// 历史: 同 onebot/api/msg.ts 的特定会话特殊处理, 改为可配置数组, 默认空=不跳过。 +// 如需旧行为: NAPCAT_SPECIAL_PEER_UINS='284840486,1094950020' +const SPECIAL_PEER_UINS: string[] = (process.env['NAPCAT_SPECIAL_PEER_UINS'] ?? '') + .split(',') + .map(s => s.trim()) + .filter(s => /^\d+$/.test(s)); + function replyElementToText (replyElement: any, msg: RawMessage, recursiveLevel: number): string { const recordMsgOrNull = msg.records.find((record) => replyElement.sourceMsgIdInRecords === record.msgId); - return `[回复消息 ${recordMsgOrNull && recordMsgOrNull.peerUin !== '284840486' && recordMsgOrNull.peerUin !== '1094950020' + return `[回复消息 ${recordMsgOrNull && !SPECIAL_PEER_UINS.includes(recordMsgOrNull.peerUin) ? rawMessageToText(recordMsgOrNull, recursiveLevel + 1) : `未找到消息记录 (MsgId = ${replyElement.sourceMsgIdInRecords})` }]`; diff --git a/packages/snowcat-onebot/api/msg.ts b/packages/snowcat-onebot/api/msg.ts index efa3f37..df179b4 100644 --- a/packages/snowcat-onebot/api/msg.ts +++ b/packages/snowcat-onebot/api/msg.ts @@ -1,4 +1,12 @@ import { FileNapCatOneBotUUID } from 'snowcat-common/src/file-uuid'; + +// 历史: 特定会话(如文件传输助手/官方助手类号)走特殊回包与视频URL通道。 +// 改造: 从硬编码字面量改为可配置数组(环境变量优先, 默认空=不做特殊处理), 保留原分支结构。 +// 如需恢复旧行为, 配置 NAPCAT_SPECIAL_PEER_UINS='284840486,1094950020' 即可。 +const SPECIAL_PEER_UINS: string[] = (process.env['NAPCAT_SPECIAL_PEER_UINS'] ?? '') + .split(',') + .map(s => s.trim()) + .filter(s => /^\d+$/.test(s)); import { MessageUnique } from 'snowcat-common/src/message-unique'; import { ChatType, @@ -298,7 +306,7 @@ export class OneBotMsgApi { const records = msg.records.find(msgRecord => msgRecord.msgId === element?.sourceMsgIdInRecords); // 特定账号的特殊处理 - if (records && (records.peerUin === '284840486' || records.peerUin === '1094950020')) { + if (records && (SPECIAL_PEER_UINS.includes(records.peerUin))) { return createReplyData(records.msgId); } @@ -416,7 +424,7 @@ export class OneBotMsgApi { // 读取视频链接并兜底 let videoUrlWrappers: Awaited> | undefined; - if (msg.peerUin === '284840486' || msg.peerUin === '1094950020') { + if (SPECIAL_PEER_UINS.includes(msg.peerUin)) { try { videoUrlWrappers = await this.core.apis.FileApi.getVideoUrl({ chatType: msg.chatType, @@ -1171,7 +1179,7 @@ export class OneBotMsgApi { resMsg.sender.nickname = member?.nick ?? member?.cardName ?? '临时会话'; resMsg.temp_source = 0; } else { - resMsg.group_id = 284840486; + resMsg.group_id = SPECIAL_PEER_UINS[0] ? parseInt(SPECIAL_PEER_UINS[0]) : 0; resMsg.temp_source = 0; resMsg.sender.nickname = '临时会话'; }