Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion astrbot/core/platform/sources/dingtalk/dingtalk_event.py
Original file line number Diff line number Diff line change
Expand Up @@ -25,14 +25,28 @@ async def send_with_client(
client: dingtalk_stream.ChatbotHandler,
message: MessageChain,
):
icm = cast(dingtalk_stream.ChatbotMessage, self.message_obj.raw_message)
ats = []
# fixes: #4218
# 钉钉 at 机器人需要使用 sender_staff_id 而不是 sender_id
for i in message.chain:
if isinstance(i, Comp.At):
print(i.qq, icm.sender_id, icm.sender_staff_id)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚨 issue (security): 删除调试用的 print,以避免产生噪声日志并防止潜在的个人敏感信息泄露。

这些 ID(包括 sender_staff_id)都是敏感信息。直接记录到日志中可能会暴露用户信息,并让生产环境的日志变得杂乱。请移除这个 print,或者在确实需要这些信息进行调试时,使用项目中的日志记录器、设置合适的日志级别并对敏感信息做脱敏处理。

Original comment in English

🚨 issue (security): Remove the debug print to avoid noisy logs and potential PII leakage.

These IDs (including sender_staff_id) are sensitive. Logging them directly can expose user information and clutter production logs. Please remove this print, or use the project logger with an appropriate level and redaction if you need this information for debugging.

if str(i.qq) in str(icm.sender_id or ""):
# 适配器会将开头的 $:LWCP_v1:$ 去掉,因此我们用 in 判断
ats.append(f"@{icm.sender_staff_id}")
else:
ats.append(f"@{i.qq}")
at_str = " ".join(ats)

for segment in message.chain:
if isinstance(segment, Comp.Plain):
segment.text = segment.text.strip()
await asyncio.get_event_loop().run_in_executor(
None,
client.reply_markdown,
segment.text,
segment.text,
f"{at_str} {segment.text}".strip(),
cast(dingtalk_stream.ChatbotMessage, self.message_obj.raw_message),
)
elif isinstance(segment, Comp.Image):
Expand Down