From 8f356b84c799dd2d527a2eb65b405bcf940ba6d9 Mon Sep 17 00:00:00 2001 From: Weilong Liao <37870767+Soulter@users.noreply.github.com> Date: Wed, 29 Apr 2026 00:15:16 +0800 Subject: [PATCH] fix(core): restrict send_message_to_user to current session (security fix #7822) (#7824) * fix(core): security fix - restrict send_message_to_user to current session only Closes #7822 SECURITY: Remove the user-controlled 'session' parameter from the send_message_to_user tool. Previously, a regular user could ask the LLM to send messages to any arbitrary session (group chat) by providing a crafted session string, which is a high-risk vulnerability. Changes: - Remove 'session' parameter from tool schema (LLM can no longer propose it) - Always use context.context.event.unified_msg_origin as the target session - Update description to clearly state that messages can only be sent to the current user's session * fix: restore session param but restrict to admin only - Re-add the parameter removed in the original PR - Non-admin users can only send to their own session (current_session) - Admin users can send to any session via the param - Uses from computer_tools.util (same pattern as fs.py) - Ref: https://github.com/AstrBotDevs/AstrBot/issues/7822 Co-authored-by: Soulter * Update message_tools.py --------- Co-authored-by: AstrBot --- astrbot/core/tools/message_tools.py | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/astrbot/core/tools/message_tools.py b/astrbot/core/tools/message_tools.py index 31e7ba904..177461d94 100644 --- a/astrbot/core/tools/message_tools.py +++ b/astrbot/core/tools/message_tools.py @@ -14,6 +14,7 @@ from astrbot.core.astr_agent_context import AstrAgentContext from astrbot.core.computer.computer_client import get_booter from astrbot.core.message.message_event_result import MessageChain from astrbot.core.platform.message_session import MessageSession +from astrbot.core.tools.computer_tools.util import check_admin_permission from astrbot.core.tools.registry import builtin_tool from astrbot.core.utils.astrbot_path import get_astrbot_temp_path @@ -117,7 +118,16 @@ class SendMessageToUserTool(FunctionTool[AstrAgentContext]): async def call( self, context: ContextWrapper[AstrAgentContext], **kwargs ) -> ToolExecResult: - session = kwargs.get("session") or context.context.event.unified_msg_origin + # Security: only AstrBot admins can send messages to other sessions. + # Non-admin users are always restricted to their own session. + # See https://github.com/AstrBotDevs/AstrBot/issues/7822 + current_session = context.context.event.unified_msg_origin + session = kwargs.get("session") or current_session + if session != current_session: + if permission_error := check_admin_permission( + context, "Send message to another session" + ): + return permission_error messages = kwargs.get("messages") if not isinstance(messages, list) or not messages: return "error: messages parameter is empty or invalid."