mirror of
https://github.com/langbot-app/LangBot.git
synced 2026-10-22 16:35:20 +08:00
carfeii
7b7f1d20f4
The Lark/Feishu webhook handler (both the current lark-omni adapter and the legacy lark adapter) parsed and dispatched inbound HTTP callback events without checking Lark's own X-Lark-Signature header, and the Encrypt Key config field used to decrypt payloads is optional and empty by default. Any caller who reached a bot's webhook URL could inject fabricated message/card-action events with an attacker-chosen sender, chat, and content. Add signature verification matching Lark's documented event-security-verification scheme (sha256 of timestamp + nonce + encrypt_key + body, compared to X-Lark-Signature) to both implementations, rejecting any callback that lacks a valid signature or whose bot has no Encrypt Key configured. Adds regression tests covering the rejection paths and updates the two existing webhook tests to present a valid signature.