fix(session): prevent stale threadId leaking into non-thread sessions#18528
Merged
steipete merged 1 commit intoopenclaw:mainfrom Feb 16, 2026
Merged
fix(session): prevent stale threadId leaking into non-thread sessions#18528steipete merged 1 commit intoopenclaw:mainfrom
steipete merged 1 commit intoopenclaw:mainfrom
Conversation
When a user interacts with the bot inside a DM topic (thread), the session persists `lastThreadId`. If the user later sends a message from the main DM (no topic), `ctx.MessageThreadId` is undefined and the `||` fallback picks up the stale persisted value — causing the bot to reply into the old topic instead of the main conversation. Only fall back to `baseEntry.lastThreadId` for thread sessions where the fallback is meaningful (e.g. consecutive messages in the same thread). Non-thread sessions now correctly leave threadId unset. Co-Authored-By: Claude Opus 4.6 <[email protected]>
chilu18
added a commit
to chilu18/openclaw
that referenced
this pull request
Feb 19, 2026
Addresses openclaw#18528: Thread ID leakage in error messages and logs Comprehensive security documentation for preventing thread/session ID leakage through error messages, API responses, and logs. Security impacts documented: 1. Conversation enumeration - sequential scanning of leaked thread IDs Attack: Use exposed thread_12345 to try thread_12346, 12347, etc. Impact: Access to conversations not owned by attacker 2. Cross-session contamination - injecting leaked thread ID in API requests Attack: Send messages to wrong conversation via leaked ID Impact: Data leakage, privacy violation 3. Replay attacks - reusing leaked session IDs Attack: Resume expired sessions with leaked thread ID Impact: Unauthorized session access Common leakage vectors: - Error messages exposing internal thread IDs to users - API responses including internal identifiers - Stack traces with thread ID parameters - Webhook payloads to external services - Client-side console logs in production Detection methods provided: - Scan error messages for ID patterns (thread_, session_, conv_) - Inspect API responses for internal identifiers - Monitor webhook payloads for ID exposure - Review client-side code for console.log leaks Remediation steps: 1. Audit error handling - find all error throws with IDs 2. Implement error sanitizer - regex replace internal IDs 3. Use opaque identifiers - SHA256 hash for external use 4. Configure production logging - disable debug, sanitize errors 5. Validate external integrations - check webhook payloads Testing scenarios: - Invalid thread ID → generic "not found" error - Unauthorized access → "access denied" not "belongs to user_X" - Stack traces → no thread IDs in traces Code examples provided: - Error sanitizer utility (regex replacements) - Opaque identifier generation (SHA256 hash) - Reverse lookup with mapping table - Response sanitization middleware - Log pattern detection script Best practices: - Principle of least information (expose only what's needed) - Separate internal/external IDs - Sanitize all user-facing output by default - Log detailed info internally, show generic errors publicly - Regular security audits (monthly/quarterly) Configuration recommendations: - sanitizeErrors: true - includeInternalIds: false - stackTracesInProduction: false - errorFormat: "generic" Related: openclaw#20912 (API key exposure), openclaw#20914 (plugin fail-open) Co-Authored-By: Claude Opus 4.6 <[email protected]>
This was referenced Feb 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
lastThreadIdfallback causing bot to reply in wrong Telegram DM topicProblem/Context
When a user interacts with the bot inside a DM topic/thread, the session persists
lastThreadId. If the user later sends a plain DM message (no topic),ctx.MessageThreadIdisundefinedand the||fallback ininitSessionStatepicks up the stale persisted thread ID — causing the bot to reply into the old topic instead of the main conversation.This is particularly confusing for Telegram DMs with topics enabled, where the bot creates a phantom topic visible only as "#" in the topic list.
Solution
Only fall back to
baseEntry.lastThreadIdfor thread sessions (whereisThreadis true). Non-thread sessions now correctly leavethreadIdunset, preventing cross-session thread ID leakage.Test Plan
Sign-Off
lastThreadIdfallback in session state initialization. Verified fix with new tests.isThreadflag was already computed earlier ininitSessionState— reusing it for the guard keeps the change minimal.—Calculon, Actor Extraordinaire (feat. Opus 4.6)
Greptile Summary
Adds defensive guard to prevent non-thread sessions from inheriting stale
lastThreadIdfrom previous thread interactions. The fix correctly scopes thebaseEntry?.lastThreadIdfallback to only apply whenisThreadis true, preventing thread ID leakage between thread and non-thread sessions. Includes comprehensive tests covering both the fix scenario (non-thread not inheriting stale threadId) and the preservation scenario (thread sessions correctly maintaining threadId).Confidence Score: 5/5
Last reviewed commit: 4ba2da4