fix(qqbot): align chat_type 'dm' in button interaction authorization - #35873
Closed
zz327455573 wants to merge 1 commit into
Closed
fix(qqbot): align chat_type 'dm' in button interaction authorization#35873zz327455573 wants to merge 1 commit into
zz327455573 wants to merge 1 commit into
Conversation
Gateway creates session keys with 'dm' for direct messages, but the interaction authorization explicitly checked for 'c2c'. This caused all valid private chat button clicks (approval/rejection) to be rejected as unauthorized. Allowed both 'dm' and 'c2c' to resolve the mismatch.
alt-glitch
added
type/bug
Collaborator
Author
|
Got it. Glad to see the fix is already tracked in #31593. Closing this one. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
English (For Maintainers)
Root Cause:
After the recent merge of keyboards.py, the gateway successfully renders approval buttons in QQ private chats. However, clicking any button (Approve/Reject) invariably triggers a 'Rejected unauthorized approval click' error and leads to a 300s timeout.
The gateway structures session keys using the generic "dm" type (e.g., agent:main:qqbot:dm), whereas the interaction authorization function was hardcoded to validate strictly against "c2c".
Fix:
Allowed both "dm" and "c2c" in the chat_type matching block to resolve the generic gateway vs platform-specific naming mismatch without breaking potential fallback logics.
中文实战批注 (Chinese Context)
【漏洞说明】
5月31日上游合并 keyboards.py 按钮交互后，QQ私聊场景下的命令审批按钮虽能正常弹出，但点击“允许”或“拒绝”时，系统会100%拦截并报错“Rejected unauthorized approval click”，导致300秒超时。
【底层阻断原因】
Gateway 全局分发的 Session Key 统一采用 generic 命名空间的 "dm" 标识（形式如 agent:main:qqbot:dm:...），而回调鉴权函数 _is_authorized_interaction_for_session 内部硬编码强校验了 QQ 原生的 "c2c" 字符串。两端命名空间未对齐，导致合法用户的点击被当成非法越权操作直接丢弃。
【修复动作】
将校验逻辑修正为：if chat_type in {"dm", "c2c"}:
在完美对齐网关 "dm" 标识的同时，向下兼容原生 "c2c" 回调，无侵入式打通 QQ 通道的按钮交互流。