fix: sanitize Lark platform id suffixes#8768
Conversation
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- Consider extracting
sanitizePlatformIdPartand the validation regex forplatformIdValidinto a shared utility or constant so the allowed/forbidden character set stays in sync over time. - Since
sanitizePlatformIdPartstrips all whitespace rather than replacing it with a delimiter, IDs derived from different bot names may collide more easily (e.g.,"a b"vs"ab"); consider whether collapsing whitespace to a single separator (e.g.,_or-) better matches the intended uniqueness semantics.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Consider extracting `sanitizePlatformIdPart` and the validation regex for `platformIdValid` into a shared utility or constant so the allowed/forbidden character set stays in sync over time.
- Since `sanitizePlatformIdPart` strips all whitespace rather than replacing it with a delimiter, IDs derived from different bot names may collide more easily (e.g., `"a b"` vs `"ab"`); consider whether collapsing whitespace to a single separator (e.g., `_` or `-`) better matches the intended uniqueness semantics.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
There was a problem hiding this comment.
Code Review
This pull request refactors platform ID sanitization by introducing a centralized sanitizePlatformIdPart method and updates frontend validation to reject whitespace in platform IDs. The review feedback identifies a critical mismatch between frontend and backend validation that could lock out existing users with whitespace in their platform IDs. Additionally, it points out a redundant .trim() call in the new sanitization helper.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| return false; | ||
| } | ||
| return !/[!:]/.test(id); | ||
| return !/[!:\s]/.test(id); |
There was a problem hiding this comment.
Mismatch between Frontend and Backend Validation (Potential Regression for Existing Users)
The frontend now rejects whitespace in platform IDs via isPlatformIdValid (using !/[!:\s]/.test(id)). However, the backend's validation in astrbot/core/platform/manager.py (_is_valid_platform_id) still only checks for : and !:
def _is_valid_platform_id(self, platform_id: str | None) -> bool:
if not platform_id:
return False
return ":" not in platform_id and "!" not in platform_idThis mismatch introduces a usability issue/regression:
- If an existing user has a platform ID containing whitespace (e.g.,
lark-藤田琴音 Botcreated in an older version), the backend will load it successfully on startup. - When the user opens the dashboard and tries to edit/update any settings for this platform, the frontend's
updatePlatformmethod will validate the ID usingisPlatformIdValid(id). - Since the ID contains whitespace, validation will fail, and the user will be completely blocked from saving any changes.
- Because the platform ID field is disabled/not editable in edit mode, the user cannot fix the ID from the UI.
Suggested Resolution
To prevent users from being locked out of editing their existing platforms, please update _is_valid_platform_id and _sanitize_platform_id in astrbot/core/platform/manager.py to handle whitespace characters (e.g., by removing them or replacing them with underscores), so that any existing platform IDs with spaces are automatically migrated/sanitized when the server starts.
| sanitizePlatformIdPart(value) { | ||
| return String(value || "") | ||
| .trim() | ||
| .replace(/\s+/g, "") | ||
| .replace(/[!:]/g, "_"); | ||
| }, |
There was a problem hiding this comment.
Redundant .trim() call
In sanitizePlatformIdPart, calling .trim() is redundant because it is immediately followed by .replace(/\s+/g, ""), which globally removes all whitespace characters (including leading, trailing, and internal spaces/tabs/newlines) from the string.
We can simplify the function by removing .trim().
sanitizePlatformIdPart(value) {
return String(value || "")
.replace(/\s+/g, "")
.replace(/[!:]/g, "_");
},
Fixes #8726.
Modifications / 改动点
Sanitize generated platform ID suffixes with the same path for explicit suffixes and registered bot names.
Strip whitespace from the generated Lark bot-name suffix, so a bot name like
藤田琴音 Botproduceslark-藤田琴音Botinstead of an ID containing spaces around or inside the suffix.Reject whitespace in manually edited platform IDs, matching the routing path that later resolves UMOs by exact
platform.meta().id.This is NOT a breaking change. / 这不是一个破坏性变更。
Screenshots or Test Results / 运行截图或测试结果
Verification run locally:
npm run buildcompleted successfully and regenerated the dashboard bundle locally. No generated assets or dependency files are included in this PR.Checklist / 检查清单
😊 If there are new features added in the PR, I have discussed it with the authors through issues/emails, etc.
/ 如果 PR 中有新加入的功能，已经通过 Issue / 邮件等方式和作者讨论过。
👀 My changes have been well-tested, and "Verification Steps" and "Screenshots" have been provided above.
/ 我的更改经过了良好的测试，并已在上方提供了“验证步骤”和“运行截图”。
🤓 I have ensured that no new dependencies are introduced, OR if new dependencies are introduced, they have been added to the appropriate locations in
requirements.txtandpyproject.toml./ 我确保没有引入新依赖库，或者引入了新依赖库的同时将其添加到
requirements.txt和pyproject.toml文件相应位置。😮 My changes do not introduce malicious code.
/ 我的更改没有引入恶意代码。
Summary by Sourcery
Ensure platform IDs generated and edited in the dashboard use a consistently sanitized suffix and reject invalid characters.
Bug Fixes:
Enhancements: