🔒 Aisle Security Analysis

We found 1 potential security issue(s) in this PR:

1. 🔵 Untrusted Feishu API error message logged verbatim (info leak + possible log forging)

Description

In resolveFeishuSenderName, suppressed permission errors are now logged with permErr.message, which is taken directly from the Feishu API response (axiosErr.response.data.msg) without any sanitization.

This introduces two concrete risks:

• Information disclosure (CWE-532): Feishu’s msg can include a permission grant URL and identifiers (e.g., app IDs / deployment domains / scopes). This data will be written to logs even when the code intentionally suppresses the user-facing notice.
• Log injection / forging (CWE-117): Because msg is untrusted remote text, it may contain newlines/control characters. When runtime.log resolves to console.log (the default in several call sites), embedded newlines can create additional fake log lines and confuse downstream log parsing/alerting.

Vulnerable code:

if (shouldSuppressPermissionErrorNotice(permErr)) {
  log(`feishu: ignoring stale permission scope error: ${permErr.message}`);
  return {};
}

Data flow evidence:

• Source: extractPermissionError() sets message: msg where msg = feishuErr.msg ?? "" from err.response.data (remote API response)
• Sink: log(...) call interpolates permErr.message directly into output

Recommendation

Avoid logging the full remote error message, or sanitize it before logging.

Option A (preferred): log only stable/safe fields

if (shouldSuppressPermissionErrorNotice(permErr)) {
  log(`feishu: ignoring stale permission scope error: code=${permErr.code}`);
  return {};
}

Option B: sanitize + truncate before logging (if message is needed for debugging)

const sanitizeForLog = (value: string) =>
  value.replace(/[\r\n\t\0\u001b]/g, " ").slice(0, 200);

if (shouldSuppressPermissionErrorNotice(permErr)) {
  log(
    `feishu: ignoring stale permission scope error: code=${permErr.code} msg=${sanitizeForLog(permErr.message)}`,
  );
  return {};
}

Additionally consider redacting/omitting URLs in logs (e.g., replace https://... with <redacted_url>), since grant URLs and app identifiers may be sensitive in some deployments.

Analyzed PR: #31870 at commit 6594d46

_{Last updated on: 2026-03-02T16:17:05Z}

Greptile Summary

This PR adds a targeted suppressor for stale Feishu permission errors during sender name lookup. When the API returns error code 99991672 with the stale scope contact:contact.base:readonly, the error is suppressed and logged, allowing message dispatch to continue without injecting misleading permission grant prompts.

Key changes:

• Added IGNORED_PERMISSION_SCOPE_TOKENS constant with the stale scope token
• Implemented shouldSuppressPermissionErrorNotice() to check if permission errors should be suppressed based on message content
• Modified resolveFeishuSenderName() to suppress errors matching stale scope tokens
• Added comprehensive regression test verifying suppression works correctly while preserving normal message flow

Impact: Users will no longer see false permission grant prompts for the non-existent stale scope, improving the user experience while maintaining proper error handling for legitimate permission issues.

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The change is a simple, well-tested bug fix with narrow scope. The suppression logic uses case-insensitive substring matching on a specific known stale scope token, includes proper logging, maintains backward compatibility for valid errors, and has comprehensive test coverage verifying the expected behavior.
• No files require special attention

_{Last reviewed commit: 6594d46}

PR #31870 - fix(feishu): suppress stale missing-scope grant notices (#31870)

Merged after verification.

• Merge commit: 55f0463
• Verified: pnpm install --frozen-lockfile, pnpm build, pnpm check (with unrelated baseline lint failure in src/browser/chrome.ts)
• Autoland updates:
  M\tCHANGELOG.md
  M\textensions/feishu/src/bot.test.ts
  M\textensions/feishu/src/bot.ts
• Rationale:
  Rebased onto latest main and preserved stale-scope suppression behavior for sender-name lookup permission errors to reduce repeated false grant notices.
• Changelog: CHANGELOG.md updated=true required=true opt_out=false