trace_02a515699d714d879f22e6df6c7da152

/workspace
import type { IncomingMessage, ServerResponse } from "node:http";
import { safeEqualSecret } from "openclaw/plugin-sdk/browser-support";
import type { ResolvedZaloAccount } from "./accounts.js";
import type { ZaloFetch, ZaloUpdate } from "./api.js";
import type { ZaloRuntimeEnv } from "./monitor.js";
import {
  createDedupeCache,
  createFixedWindowRateLimiter,
  createWebhookAnomalyTracker,
  readJsonWebhookBodyOrReject,
  applyBasicWebhookRequestGuards,

/workspace/extensions/zalo/src/api.test.ts:2:import { deleteWebhook, getWebhookInfo, sendChatAction, type ZaloFetch } from "./api.js";
/workspace/extensions/zalo/src/api.test.ts:26:  it("aborts sendChatAction when the typing timeout elapses", async () => {
/workspace/extensions/zalo/src/api.test.ts:38:      const promise = sendChatAction(
/workspace/extensions/zalo/src/api.test.ts:41:          chat_id: "chat-123",
/workspace/extensions/zalo/src/api.ts:24:  message_id: string;
/workspace/extensions/zalo/src/api.ts:32:  chat: {
/workspace/extensions/zalo/src/api.ts:34:    chat_type: "PRIVATE" | "GROUP";
/workspace/extensions/zalo/src/api.ts:54:  chat_id: string;
/workspace/extensions/zalo/src/api.ts:59:  chat_id: string;
/workspace/extensions/zalo/src/api.ts:64:export type ZaloSendChatActionParams = {
/workspace/extensions/zalo/src/api.ts:65:  chat_id: string;
/workspace/extensions/zalo/src/api.ts:179: * Send a temporary chat action such as typing.

      processUpdate({ update, target }).catch((err) => {
        target.runtime.error?.(`[${target.account.accountId}] Zalo webhook failed: ${String(err)}`);
      });

      res.statusCode = 200;
      res.end("ok");
      return true;
    },
  });
}

          body: JSON.stringify(payload),
        });

        expect(first.status).toBe(200);
        expect(second.status).toBe(200);
      });

      expect(sinkA).toHaveBeenCalledTimes(1);
      expect(sinkB).toHaveBeenCalledTimes(1);
    } finally {
      unregisterA();
      unregisterB();

/**
 * Zalo Bot API client
 * @see https://bot.zaloplatforms.com/docs
 */

const ZALO_API_BASE = "https://bot-api.zaloplatforms.com";

export type ZaloFetch = (input: string, init?: RequestInit) => Promise<Response>;

export type ZaloApiResponse<T = unknown> = {
  ok: boolean;
  result?: T;

/workspace/extensions/feishu/src/test-support/lifecycle-test-support.ts
/workspace/extensions/zalo/test-support/lifecycle-test-support.ts

import { request as httpRequest } from "node:http";
import type { OpenClawConfig, PluginRuntime } from "openclaw/plugin-sdk/zalo";
import { expect, vi } from "vitest";
import { createPluginRuntimeMock } from "../../../test/helpers/plugins/plugin-runtime-mock.js";
import type { ResolvedZaloAccount } from "../src/types.js";

export function createLifecycleConfig(params: {
  accountId: string;
  dmPolicy: "open" | "pairing";
  allowFrom?: string[];
  webhookUrl?: string;
  webhookSecret?: string;

    const req = httpRequest(
      url,
      {
        method: "POST",
        headers: {
          "content-type": "application/json",
          "content-length": Buffer.byteLength(body),
          "x-bot-api-secret-token": params.secret,
        },
      },
      (res) => {
        const chunks: Buffer[] = [];

{
"executiveSummary": "The Zalo webhook replay filter in extensions/zalo/src/monitor.webhook.ts constructs its deduplication key from only target.path, target.account.accountId, update.event_name, and update.message.message_id. It omits both chat identity and sender identity, even though inbound Zalo messages carry message.chat.id and message.from.id. Because replay classification is performed before processing, two legitimate events that share the same event_name and message_id but originate from different chats or different senders under the same authenticated target will collide in the dedupe cache for 5 minutes, causing the later event to be treated as a replay and silently dropped.",
"reports": [
{
"title": "Zalo webhook replay dedupe key is not scoped by chat or sender",
"severity": "HIGH",
"summary": "Inbound Zalo webhook events are classified as replays using a cache key of `${target.path}:${target.account.accountId}:${update.event_name}:${messageId}`. The key ignores message.chat.id and message.from.id, so distinct legitimate events from different chats or different senders that reuse the same message_id within the replay window can be suppressed as duplicates.",
"rootCauseAnalysis": "The replay check in isReplayEvent() reads only update.message?.message_id and returns recentWebhookEvents.check(key, nowMs) for a key built as `${target.path}:${target.account.accountId}:${update.event_name}:${messageId}`. The Zalo payload schema shows that each inbound message also contains from.id and chat.id, but those dimensions are not included in the dedupe key. handleZaloWebhookRequest() calls isReplayEvent() before invoking processUpdate(), and when the check matches it returns HTTP 200 immediately, preventing downstream processing of the second event.",
"impact": "A valid inbound event can be lost if another event under the same webhook path/account/event_name uses the same message_id during the 5-minute replay window. This breaks message integrity and can cause denial of service for user messages, especially where message_id values are only unique within a conversation or sender scope rather than globally. The effect is that one user's or one chat's real message can suppress another user's or another chat's real message.",
"attackPath": "An attacker or simply normal platform behavior causes two webhook deliveries under the same target.path and accountId to have the same event_name and message.message_id but different message.chat.id and/or message.from.id. The first request stores the dedupe key. The second request reaches handleZaloWebhookRequest(), isReplayEvent() recomputes the same key because chat and sender are omitted, recentWebhookEvents.check() marks it as seen, and the handler responds 200 'ok' without processing the later legitimate event.",
"stepsToReproduce": [
"Inspect extensions/zalo/src/monitor.webhook.ts and note that isReplayEvent() builds the replay key as `${target.path}:${target.account.accountId}:${update.event_name}:${messageId}`.",