Skip to content

fix(telegram): validate replyToMessageId before sending to Telegram API#56587

Merged
hydro13 merged 1 commit intoopenclaw:mainfrom
hydro13:fix/telegram-reply-id-validation
Mar 28, 2026
Merged

fix(telegram): validate replyToMessageId before sending to Telegram API#56587
hydro13 merged 1 commit intoopenclaw:mainfrom
hydro13:fix/telegram-reply-id-validation

Conversation

@hydro13
Copy link
Copy Markdown
Member

@hydro13 hydro13 commented Mar 28, 2026

Summary

  • Add shared normalizeTelegramReplyToMessageId() normalizer in outbound-params.ts
  • Apply at all four Telegram API sinks: direct send, bot delivery, draft stream, bot helpers
  • Rejects non-numeric strings, NaN, mixed-content strings ("123abc"), whitespace
  • Prevents GrammyError 400 when non-numeric values from session metadata slip through

Root Cause

Telegram's Bot API expects reply_to_message_id to be a numeric integer. Multiple call sites passed the value through without validation, trusting typed boundaries. When runtime values like session metadata IDs ("session-meta-id") reached the API, Grammy rejected the send.

Change Type

  • Bug fix

Testing

139 tests pass across 3 test files. New regression test covers:

  • Non-numeric string ("session-meta-id") → omitted
  • Mixed-content string ("123abc") → omitted
  • NaN → omitted
  • Verified for both sendMessage and sendSticker paths

Fixes #37222

@hydro13
fix(telegram): validate replyToMessageId before sending to Telegram API
876919c 
Add shared normalizeTelegramReplyToMessageId() that rejects non-numeric,
NaN, and mixed-content strings before they reach the Telegram Bot API.
Apply at all four API sinks: direct send, bot delivery, draft stream,
and bot helpers.

Prevents GrammyError 400 when non-numeric values from session metadata
slip through typed boundaries.

Fixes openclaw#37222
@openclaw-barnacle openclaw-barnacle Bot added channel: telegram Channel integration: telegram size: S maintainer Maintainer-authored PR labels Mar 28, 2026
@greptile-apps
Copy link
Copy Markdown
Contributor

greptile-apps Bot commented Mar 28, 2026

Greptile Summary

This PR centralises reply_to_message_id validation into a single normalizeTelegramReplyToMessageId() helper and applies it at all four Telegram API call sites (send.ts, delivery.send.ts, draft-stream.ts, bot/helpers.ts). The fix prevents the GrammyError 400 that occurred when non-numeric session-metadata strings reached the Bot API.

  • outbound-params.ts — new normalizeTelegramReplyToMessageId(unknown) replaces ad-hoc guards at each call site; the legacy parseTelegramReplyToMessageId is now a thin delegating wrapper, preserving the public API.
  • bot/helpers.ts — resolveTelegramReplyId becomes a one-liner; the old Number(raw) path that could return floats (e.g. \"123.5\" → 123.5) is removed in favour of the strict integer regex.
  • send.ts — Math.trunc(params.replyToMessageId) guard replaced; previously a string like \"session-meta-id\" would silently produce NaN and be forwarded as message_id.
  • send.test.ts — new parameterised regression test covers \"session-meta-id\", \"123abc\", and NaN for both sendMessageTelegram and sendStickerTelegram.

The implementation looks correct and complete. No critical issues found.

Confidence Score: 5/5

Safe to merge — the fix is narrowly scoped, all four send paths are covered, and 139 tests pass.

All findings are P2 or lower. The core validation logic is correct, the regex /^-?\d+$/ rejects every described invalid input, the normalizer is applied consistently across all sinks, and the regression test directly reproduces the bug. No breaking contract changes for callers of the exported functions.

No files require special attention.

Important Files Changed
Filename Overview
extensions/telegram/src/outbound-params.ts Introduces normalizeTelegramReplyToMessageId(unknown) as the single source of truth for reply-ID validation; delegates the legacy parseTelegramReplyToMessageId to it.
extensions/telegram/src/bot/helpers.ts resolveTelegramReplyId is now a one-liner delegating to normalizeTelegramReplyToMessageId; removes the old Number(raw) path that could return floats.
extensions/telegram/src/bot/delivery.send.ts buildTelegramSendParams validates replyToMessageId through the normalizer before placing it into API params.
extensions/telegram/src/draft-stream.ts createTelegramDraftStream now validates replyToMessageId through the normalizer; rest of streaming logic unchanged.
extensions/telegram/src/send.ts buildTelegramThreadReplyParams now calls normalizeTelegramReplyToMessageId instead of the bare Math.trunc guard, covering the NaN/non-numeric bypass.
extensions/telegram/src/send.test.ts New regression test covers session-meta-id, 123abc, and NaN for both sendMessageTelegram and sendStickerTelegram paths.

Reviews (1): Last reviewed commit: "fix(telegram): validate replyToMessageId..." | Re-trigger Greptile

@hydro13 hydro13 merged commit 865160e into openclaw:main Mar 28, 2026
36 of 38 checks passed
@github-actions github-actions Bot mentioned this pull request Mar 28, 2026
Open
hydro13 added a commit to hydro13/openclaw that referenced this pull request Mar 28, 2026
@hydro13
chore: backfill changelog entries for recent fixes
7e0129f 
Add missing changelog entries for PRs openclaw#56500, openclaw#56540, openclaw#56555, openclaw#56567,
openclaw#56573, openclaw#56587, openclaw#56595, openclaw#56612, openclaw#56620.
@hydro13 hydro13 mentioned this pull request Mar 28, 2026
Merged
hydro13 added a commit that referenced this pull request Mar 28, 2026
@hydro13
chore: backfill changelog entries for recent fixes (#56625)
2022dfd 
Add missing changelog entries for PRs #56500, #56540, #56555, #56567,
#56573, #56587, #56595, #56612, #56620.
alexcode-cc pushed a commit to alexcode-cc/clawdbot that referenced this pull request Mar 30, 2026
@hydro13
fix(telegram): validate replyToMessageId before sending to Telegram A…
d3f973e 
…PI (openclaw#56587)

Add shared normalizeTelegramReplyToMessageId() that rejects non-numeric,
NaN, and mixed-content strings before they reach the Telegram Bot API.
Apply at all four API sinks: direct send, bot delivery, draft stream,
and bot helpers.

Prevents GrammyError 400 when non-numeric values from session metadata
slip through typed boundaries.

Fixes openclaw#37222
alexcode-cc pushed a commit to alexcode-cc/clawdbot that referenced this pull request Mar 30, 2026
@hydro13
chore: backfill changelog entries for recent fixes (openclaw#56625)
3fbb703 
Add missing changelog entries for PRs openclaw#56500, openclaw#56540, openclaw#56555, openclaw#56567,
openclaw#56573, openclaw#56587, openclaw#56595, openclaw#56612, openclaw#56620.
alexjiang1 pushed a commit to alexjiang1/openclaw that referenced this pull request Mar 31, 2026
@hydro13
fix(telegram): validate replyToMessageId before sending to Telegram A…
21b5a79 
…PI (openclaw#56587)

Add shared normalizeTelegramReplyToMessageId() that rejects non-numeric,
NaN, and mixed-content strings before they reach the Telegram Bot API.
Apply at all four API sinks: direct send, bot delivery, draft stream,
and bot helpers.

Prevents GrammyError 400 when non-numeric values from session metadata
slip through typed boundaries.

Fixes openclaw#37222
alexjiang1 pushed a commit to alexjiang1/openclaw that referenced this pull request Mar 31, 2026
@hydro13
chore: backfill changelog entries for recent fixes (openclaw#56625)
92fb72b 
Add missing changelog entries for PRs openclaw#56500, openclaw#56540, openclaw#56555, openclaw#56567,
openclaw#56573, openclaw#56587, openclaw#56595, openclaw#56612, openclaw#56620.
pgondhi987 pushed a commit to pgondhi987/openclaw that referenced this pull request Mar 31, 2026
@hydro13 @pgondhi987
fix(telegram): validate replyToMessageId before sending to Telegram A…
47da6b6 
…PI (openclaw#56587)

Add shared normalizeTelegramReplyToMessageId() that rejects non-numeric,
NaN, and mixed-content strings before they reach the Telegram Bot API.
Apply at all four API sinks: direct send, bot delivery, draft stream,
and bot helpers.

Prevents GrammyError 400 when non-numeric values from session metadata
slip through typed boundaries.

Fixes openclaw#37222
pgondhi987 pushed a commit to pgondhi987/openclaw that referenced this pull request Mar 31, 2026
@hydro13 @pgondhi987
chore: backfill changelog entries for recent fixes (openclaw#56625)
c6881b9 
Add missing changelog entries for PRs openclaw#56500, openclaw#56540, openclaw#56555, openclaw#56567,
openclaw#56573, openclaw#56587, openclaw#56595, openclaw#56612, openclaw#56620.
lovewanwan pushed a commit to lovewanwan/openclaw that referenced this pull request Apr 28, 2026
@hydro13
fix(telegram): validate replyToMessageId before sending to Telegram A…
a05a890 
…PI (openclaw#56587)

Add shared normalizeTelegramReplyToMessageId() that rejects non-numeric,
NaN, and mixed-content strings before they reach the Telegram Bot API.
Apply at all four API sinks: direct send, bot delivery, draft stream,
and bot helpers.

Prevents GrammyError 400 when non-numeric values from session metadata
slip through typed boundaries.

Fixes openclaw#37222
lovewanwan pushed a commit to lovewanwan/openclaw that referenced this pull request Apr 28, 2026
@hydro13
chore: backfill changelog entries for recent fixes (openclaw#56625)
79c62a4 
Add missing changelog entries for PRs openclaw#56500, openclaw#56540, openclaw#56555, openclaw#56567,
openclaw#56573, openclaw#56587, openclaw#56595, openclaw#56612, openclaw#56620.
Tardisyuan pushed a commit to Tardisyuan/openclaw that referenced this pull request Apr 30, 2026
@hydro13 @Tardisyuan
fix(telegram): validate replyToMessageId before sending to Telegram A…
8cceb87 
…PI (openclaw#56587)

Add shared normalizeTelegramReplyToMessageId() that rejects non-numeric,
NaN, and mixed-content strings before they reach the Telegram Bot API.
Apply at all four API sinks: direct send, bot delivery, draft stream,
and bot helpers.

Prevents GrammyError 400 when non-numeric values from session metadata
slip through typed boundaries.

Fixes openclaw#37222
Tardisyuan pushed a commit to Tardisyuan/openclaw that referenced this pull request Apr 30, 2026
@hydro13 @Tardisyuan
chore: backfill changelog entries for recent fixes (openclaw#56625)
08adf86 
Add missing changelog entries for PRs openclaw#56500, openclaw#56540, openclaw#56555, openclaw#56567,
openclaw#56573, openclaw#56587, openclaw#56595, openclaw#56612, openclaw#56620.
ogt-redknie pushed a commit to ogt-redknie/OPENX that referenced this pull request May 2, 2026
@hydro13
fix(telegram): validate replyToMessageId before sending to Telegram A…
b481dad 
…PI (openclaw#56587)

Add shared normalizeTelegramReplyToMessageId() that rejects non-numeric,
NaN, and mixed-content strings before they reach the Telegram Bot API.
Apply at all four API sinks: direct send, bot delivery, draft stream,
and bot helpers.

Prevents GrammyError 400 when non-numeric values from session metadata
slip through typed boundaries.

Fixes openclaw#37222
ogt-redknie pushed a commit to ogt-redknie/OPENX that referenced this pull request May 2, 2026
@hydro13
chore: backfill changelog entries for recent fixes (openclaw#56625)
b55c7cb 
Add missing changelog entries for PRs openclaw#56500, openclaw#56540, openclaw#56555, openclaw#56567,
openclaw#56573, openclaw#56587, openclaw#56595, openclaw#56612, openclaw#56620.
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 9, 2026
@hydro13
fix(telegram): validate replyToMessageId before sending to Telegram A…
d74081f 
…PI (openclaw#56587)

Add shared normalizeTelegramReplyToMessageId() that rejects non-numeric,
NaN, and mixed-content strings before they reach the Telegram Bot API.
Apply at all four API sinks: direct send, bot delivery, draft stream,
and bot helpers.

Prevents GrammyError 400 when non-numeric values from session metadata
slip through typed boundaries.

Fixes openclaw#37222
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 9, 2026
@hydro13
chore: backfill changelog entries for recent fixes (openclaw#56625)
11a3385 
Add missing changelog entries for PRs openclaw#56500, openclaw#56540, openclaw#56555, openclaw#56567,
openclaw#56573, openclaw#56587, openclaw#56595, openclaw#56612, openclaw#56620.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

channel: telegram Channel integration: telegram maintainer Maintainer-authored PR size: S

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Telegram send should ignore non-numeric reply_to_message_id inputs

1 participant

@hydro13