fix(slack): reject HTML responses when downloading media by tumf · Pull Request #4665 · openclaw/openclaw

tumf · 2026-01-30T13:47:31Z

Summary

Slack sometimes returns HTML login pages instead of binary media when authentication fails (e.g., missing files:read scope) or URLs expire. This change detects and rejects HTML responses, improving error visibility.

Changes

Add looksLikeHtml() function to detect HTML content by checking:
- <!doctype html or <html prefixes
- slack-edge.com or redirecturl: patterns (Slack-specific)
Log warning when HTML is received instead of media
Skip to next file URL when HTML is detected
Add tests for HTML detection scenarios

Testing

Unit tests added and passing
Tested locally with Slack channel file uploads
Verified warning log helps identify scope/auth issues

AI Assistance

AI-assisted (Claude)
Fully tested
I understand what the code does

This fix helped diagnose a real issue where files:read scope was missing from the Slack bot token - the warning log made it clear that HTML was being returned instead of the actual file.

Greptile Overview

Greptile Summary

(placeholder)

Confidence Score: 4/5

This PR is safe to merge with low risk; behavior change is scoped to Slack media downloads and covered by unit tests.
Change is localized and defensive (skip HTML masquerading as media). Main risk is false positives from heuristic HTML detection, but the code exempts expected HTML files and tests cover key cases.
src/slack/monitor/media.ts (HTML detection heuristic)

_{(4/5) You can add custom instructions or style guidelines for the agent here!}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: da6f3e21a5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

src/slack/monitor/media.ts

greptile-apps

_{2 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

src/slack/monitor/media.ts

greptile-apps · 2026-02-03T02:25:21Z

Additional Comments (1)

src/slack/monitor/media.test.ts
[P1] The new tests don’t assert the warning log side-effect. Since the PR’s goal is improved diagnosability, it’d be useful to mock ../../logger.js and assert logWarn is called when HTML is detected (and not called for genuine HTML files). This helps prevent regressions where the guard keeps working but the visibility signal disappears.

_{Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!}

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/slack/monitor/media.test.ts
Line: 1:1

Comment:
[P1] The new tests don’t assert the warning log side-effect. Since the PR’s goal is improved diagnosability, it’d be useful to mock `../../logger.js` and assert `logWarn` is called when HTML is detected (and *not* called for genuine HTML files). This helps prevent regressions where the guard keeps working but the visibility signal disappears.

<sub>Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!</sub>

How can I resolve this? If you propose a fix, please make it concise.

tumf · 2026-02-11T23:39:02Z

Rebased onto main and addressed review feedback:

P2 Allow genuine HTML files: Fixed - now skips HTML detection for files with mimetype: text/html or .html/.htm extensions
P2 looksLikeHtml trim: Fixed - now only trims leading whitespace (replace(/^\s+/, "")) and removed slack-edge.com/redirecturl: checks, keeping only reliable <!doctype html and <html prefix detection
P1 logWarn test assertions: Added - tests now mock logWarn and assert it is called (or not called for genuine HTML files)

Slack sometimes returns HTML login pages instead of binary media when authentication fails or URLs expire. This change detects HTML responses by checking content-type header and buffer content, then skips to the next available file URL.

Cherry-pick of upstream e057139.

* fix(slack): reject HTML responses when downloading media Slack sometimes returns HTML login pages instead of binary media when authentication fails or URLs expire. This change detects HTML responses by checking content-type header and buffer content, then skips to the next available file URL. * fix: format import order and add braces to continue statement * chore: format Slack media tests * chore: apply formatter to Slack media tests * fix(slack): merge auth-header forwarding and html media guard --------- Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>

Cherry-pick of upstream e057139.

openclaw-barnacle bot added the channel: slack Channel integration: slack label Jan 30, 2026

chatgpt-codex-connector bot reviewed Jan 30, 2026

View reviewed changes

src/slack/monitor/media.ts Outdated Show resolved Hide resolved

tumf force-pushed the fix/slack-media-changes branch 2 times, most recently from 7503b9c to a6792cd Compare February 1, 2026 08:48

greptile-apps bot reviewed Feb 3, 2026

View reviewed changes

src/slack/monitor/media.ts Outdated Show resolved Hide resolved

openclaw-barnacle bot added the agents Agent runtime and tooling label Feb 3, 2026

tumf force-pushed the fix/slack-media-changes branch from 5b43c58 to 999fa64 Compare February 11, 2026 23:38

thewilloftheshadow force-pushed the main branch from bfc1ccb to f92900f Compare February 15, 2026 18:46

sebslight mentioned this pull request Feb 20, 2026

fix(slack): reject HTML error pages saved as file downloads #18903

Closed

4 tasks

This comment was marked as spam.

Sign in to view

tumf and others added 5 commits March 1, 2026 10:55

fix: format import order and add braces to continue statement

b6857bd

chore: format Slack media tests

b6f3f22

chore: apply formatter to Slack media tests

37cd19f

fix(slack): merge auth-header forwarding and html media guard

389d354

Takhoffman force-pushed the fix/slack-media-changes branch from edc1695 to 389d354 Compare March 1, 2026 17:20

openclaw-barnacle bot added size: S and removed agents Agent runtime and tooling labels Mar 1, 2026

Takhoffman merged commit e057139 into openclaw:main Mar 1, 2026
11 checks passed

This was referenced Mar 1, 2026

fix(slack): add auth header when downloading forwarded attachment images #18763

Closed

fix(slack): preserve auth across Slack-hosted file redirects #14847

Closed

github-actions bot mentioned this pull request Mar 1, 2026

📡 Upstream Digest — 2026-03-01 18:22 UTC curtismercier/openclaw-mods#154

Open

zooqueen added a commit to hanzoai/bot that referenced this pull request Mar 1, 2026

fix(slack): reject HTML responses when downloading media (openclaw#4665)

a18b6f6

Cherry-pick of upstream e057139.

zooqueen added a commit to hanzoai/bot that referenced this pull request Mar 6, 2026

fix(slack): reject HTML responses when downloading media (openclaw#4665)

0424ac0

Cherry-pick of upstream e057139.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(slack): reject HTML responses when downloading media#4665

fix(slack): reject HTML responses when downloading media#4665
Takhoffman merged 5 commits intoopenclaw:mainfrom
tumf:fix/slack-media-changes

tumf commented Jan 30, 2026 •

edited by greptile-apps bot

Loading

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

Uh oh!

greptile-apps bot left a comment

Uh oh!

Uh oh!

greptile-apps bot commented Feb 3, 2026

Uh oh!

tumf commented Feb 11, 2026

Uh oh!

This comment was marked as spam.

This comment was marked as spam.

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

tumf commented Jan 30, 2026 • edited by greptile-apps bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Testing

AI Assistance

Greptile Overview

Greptile Summary

Confidence Score: 4/5

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

greptile-apps bot commented Feb 3, 2026

Uh oh!

tumf commented Feb 11, 2026

Uh oh!

This comment was marked as spam.

This comment was marked as spam.

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

tumf commented Jan 30, 2026 •

edited by greptile-apps bot

Loading