Skip to content

security(feishu): bound unauthenticated webhook rate-limit state#26050

Merged
Takhoffman merged 2 commits intoopenclaw:mainfrom
bmendonca3:bm/feishu-webhook-rate-limit-cap-20260224
Feb 27, 2026
Merged

security(feishu): bound unauthenticated webhook rate-limit state#26050
Takhoffman merged 2 commits intoopenclaw:mainfrom
bmendonca3:bm/feishu-webhook-rate-limit-cap-20260224

Conversation

@bmendonca3
Copy link

@bmendonca3 bmendonca3 commented Feb 25, 2026 •
edited by greptile-apps bot
Loading

Summary

  • Problem: The Feishu webhook ingress rate limiter keeps per-source state in feishuWebhookRateLimits with no eviction or hard cap. Every new source key persists indefinitely.
  • Trust boundary crossed: This state is populated before webhook verification/token validation, so unauthenticated network traffic can grow process memory.
  • Impact: Sustained requests from many distinct source addresses can cause unbounded memory growth and availability degradation (high-impact DoS).
  • What changed: Added periodic stale-entry pruning and a strict maximum tracked-key bound for Feishu webhook rate-limit state.

Change Type

  • Bug fix
  • Feature
  • Refactor
  • Docs
  • Security hardening
  • Chore/infra

Scope

  • Gateway / orchestration
  • Skills / tool execution
  • Auth / tokens
  • Memory / storage
  • Integrations
  • API / contracts
  • UI / DX
  • CI/CD / infra

Security Impact

  • New permissions/capabilities? No
  • Secrets/tokens handling changed? No
  • New/changed network calls? No
  • Command/tool execution surface changed? No
  • Data access scope changed? No

Repro + Verification

Deterministic PoC (before fix)

  1. Start Feishu in webhook mode.
  2. Send requests that force distinct source keys (e.g., many unique source addresses via distributed/rotating ingress).
  3. Observe feishuWebhookRateLimits growth without bound over time.

Automated verification (this PR)

  • Added regression test that inserts 4,500 unique keys and asserts state remains bounded.
  • Added regression test that confirms stale entries are pruned after the configured window.
  • Existing webhook burst limit test remains green.

Evidence

Human Verification

  • Ran targeted tests locally with single worker:
    • pnpm exec vitest run extensions/feishu/src/monitor.webhook-security.test.ts --maxWorkers=1
  • Confirmed all tests in that file pass, including new bounds/pruning regressions.

Compatibility / Migration

  • Backward compatible? Yes
  • Config/env changes? No
  • Migration needed? No

Failure Recovery

  • Revert this commit to restore previous behavior.
  • Files to restore:
    • extensions/feishu/src/monitor.ts
    • extensions/feishu/src/monitor.webhook-security.test.ts

Risks and Mitigations

  • Risk: Evicting oldest keys under heavy churn may reduce precision for oldest buckets.
  • Mitigation: Request limiting remains enforced for active/new keys; stale-pruning plus hard cap prevents unbounded memory pressure.

Greptile Summary

Added memory bounds to the Feishu webhook rate limiter to prevent unbounded growth from unauthenticated traffic. The fix introduces a hard cap of 4,096 tracked keys and periodic pruning of stale entries older than 60 seconds. This prevents DoS attacks where distributed/rotating source addresses could exhaust process memory before webhook verification occurs at monitor.ts:306-310.

Confidence Score: 5/5

  • Safe to merge with high confidence - addresses real DoS vector with minimal risk
  • Implementation is clean and well-tested with regression coverage for both bounds enforcement and stale-entry pruning. The fix maintains backward compatibility while closing a pre-auth memory exhaustion vector.
  • No files require special attention

Last reviewed commit: b87fbd4

This was referenced Feb 25, 2026
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
@Takhoffman Takhoffman force-pushed the bm/feishu-webhook-rate-limit-cap-20260224 branch from a0b383b to 34f7eea Compare February 27, 2026 19:22
@Takhoffman Takhoffman merged commit f943c76 into openclaw:main Feb 27, 2026
9 checks passed
@Takhoffman
Copy link
Contributor

Takhoffman commented Feb 27, 2026

PR #26050 - security(feishu): bound unauthenticated webhook rate-limit state (#26050)

Merged via squash.

  • Merge commit: f943c76
  • Verified:
    • pnpm install --frozen-lockfile
    • pnpm build
    • pnpm check (fails in this environment due unrelated baseline TypeScript error in src/agents/pi-embedded-runner-extraparams.test.ts)
    • pnpm test:macmini
  • Changes made:
    CHANGELOG.md
    extensions/feishu/src/monitor.ts
    extensions/feishu/src/monitor.webhook-security.test.ts
  • Why these changes were made:
    Bound pre-auth Feishu webhook rate-limit state growth and satisfied changelog-required policy for merge.
  • Changelog: CHANGELOG.md updated=true required=true opt_out=false

Thanks @bmendonca3!

execute008 pushed a commit to execute008/openclaw that referenced this pull request Feb 27, 2026
@bmendonca3 @Takhoffman @execute008
security(feishu): bound unauthenticated webhook rate-limit state (ope…
f161210 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
velvet-shark pushed a commit to lailoo/openclaw that referenced this pull request Feb 27, 2026
@bmendonca3 @Takhoffman @velvet-shark
security(feishu): bound unauthenticated webhook rate-limit state (ope…
a6a42b8 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
r4jiv007 pushed a commit to r4jiv007/openclaw that referenced this pull request Feb 28, 2026
@bmendonca3 @Takhoffman @r4jiv007
security(feishu): bound unauthenticated webhook rate-limit state (ope…
c04a08b 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
xiexikang pushed a commit to cclawd007/cclawd that referenced this pull request Feb 28, 2026
@bmendonca3 @Takhoffman
security(feishu): bound unauthenticated webhook rate-limit state (ope…
b90af21 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
mylukin pushed a commit to mylukin/openclaw that referenced this pull request Feb 28, 2026
@bmendonca3 @Takhoffman @mylukin
security(feishu): bound unauthenticated webhook rate-limit state (ope…
10634e6 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
wanjizheng pushed a commit to wanjizheng/openclaw that referenced this pull request Feb 28, 2026
@bmendonca3 @Takhoffman @wanjizheng
security(feishu): bound unauthenticated webhook rate-limit state (ope…
fdf0eed 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
wanjizheng pushed a commit to wanjizheng/openclaw that referenced this pull request Feb 28, 2026
@bmendonca3 @Takhoffman @wanjizheng
security(feishu): bound unauthenticated webhook rate-limit state (ope…
34fc22a 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
(cherry picked from commit fdf0eed)
wanjizheng pushed a commit to wanjizheng/openclaw that referenced this pull request Feb 28, 2026
@bmendonca3 @Takhoffman @wanjizheng
security(feishu): bound unauthenticated webhook rate-limit state (ope…
1e7e55e 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
(cherry picked from commit fdf0eed)
wanjizheng pushed a commit to wanjizheng/openclaw that referenced this pull request Feb 28, 2026
@bmendonca3 @Takhoffman @wanjizheng
security(feishu): bound unauthenticated webhook rate-limit state (ope…
3bed733 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
(cherry picked from commit fdf0eed)
vincentkoc pushed a commit to Sid-Qin/openclaw that referenced this pull request Feb 28, 2026
@bmendonca3 @Takhoffman @vincentkoc
security(feishu): bound unauthenticated webhook rate-limit state (ope…
29aa9ad 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
vincentkoc pushed a commit to rylena/rylen-openclaw that referenced this pull request Feb 28, 2026
@bmendonca3 @Takhoffman @vincentkoc
security(feishu): bound unauthenticated webhook rate-limit state (ope…
f50c499 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
newtontech pushed a commit to newtontech/openclaw-fork that referenced this pull request Feb 28, 2026
@bmendonca3 @Takhoffman
security(feishu): bound unauthenticated webhook rate-limit state (ope…
11f5992 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
newtontech pushed a commit to newtontech/openclaw-fork that referenced this pull request Feb 28, 2026
@bmendonca3 @Takhoffman
security(feishu): bound unauthenticated webhook rate-limit state (ope…
11f5992 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
wanjizheng pushed a commit to wanjizheng/openclaw that referenced this pull request Mar 1, 2026
@bmendonca3 @Takhoffman @wanjizheng
security(feishu): bound unauthenticated webhook rate-limit state (ope…
47c1d40 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
wanjizheng pushed a commit to wanjizheng/openclaw that referenced this pull request Mar 1, 2026
@bmendonca3 @Takhoffman @wanjizheng
security(feishu): bound unauthenticated webhook rate-limit state (ope…
fa53809 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
@github-actions github-actions bot mentioned this pull request Mar 1, 2026
Closed
6 tasks
hughdidit pushed a commit to hughdidit/DAISy-Agency that referenced this pull request Mar 1, 2026
@bmendonca3 @Takhoffman @github-actions
security(feishu): bound unauthenticated webhook rate-limit state (ope…
cff7ec6 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
(cherry picked from commit f943c76)
@gemini-code-assist gemini-code-assist bot mentioned this pull request Mar 1, 2026
Merged
steipete pushed a commit to Sid-Qin/openclaw that referenced this pull request Mar 2, 2026
@bmendonca3 @Takhoffman @steipete
security(feishu): bound unauthenticated webhook rate-limit state (ope…
b3a1bcb 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
safzanpirani pushed a commit to safzanpirani/clawdbot that referenced this pull request Mar 2, 2026
@bmendonca3 @Takhoffman @safzanpirani
security(feishu): bound unauthenticated webhook rate-limit state (ope…
8ecc1d7 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
steipete pushed a commit to Sid-Qin/openclaw that referenced this pull request Mar 2, 2026
@bmendonca3 @Takhoffman @steipete
security(feishu): bound unauthenticated webhook rate-limit state (ope…
d693249 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
venjiang pushed a commit to venjiang/openclaw that referenced this pull request Mar 2, 2026
@bmendonca3 @Takhoffman @venjiang
security(feishu): bound unauthenticated webhook rate-limit state (ope…
41072f7 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
robertchang-ga pushed a commit to robertchang-ga/openclaw that referenced this pull request Mar 2, 2026
@bmendonca3 @Takhoffman
security(feishu): bound unauthenticated webhook rate-limit state (ope…
d96a578 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
@github-actions github-actions bot mentioned this pull request Mar 3, 2026
Closed
6 tasks
hughdidit pushed a commit to hughdidit/DAISy-Agency that referenced this pull request Mar 3, 2026
@bmendonca3 @Takhoffman @github-actions
security(feishu): bound unauthenticated webhook rate-limit state (ope…
50b1a33 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
(cherry picked from commit f943c76)
dorgonman pushed a commit to kanohorizonia/openclaw that referenced this pull request Mar 3, 2026
@bmendonca3 @Takhoffman @dorgonman
security(feishu): bound unauthenticated webhook rate-limit state (ope…
922724a 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
sachinkundu pushed a commit to sachinkundu/openclaw that referenced this pull request Mar 6, 2026
@bmendonca3 @Takhoffman
security(feishu): bound unauthenticated webhook rate-limit state (ope…
a71a91c 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
zooqueen pushed a commit to hanzoai/bot that referenced this pull request Mar 6, 2026
@bmendonca3 @Takhoffman
security(feishu): bound unauthenticated webhook rate-limit state (ope…
9177db3 
…nclaw#26050) thanks @bmendonca3

Verified:
- pnpm install --frozen-lockfile
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: bmendonca3 <208517100+bmendonca3@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

channel: feishu Channel integration: feishu size: S

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@bmendonca3 @Takhoffman