Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix [Bug]: Telegram raw-update verbose logging includes private chat payloads [1 pull requests]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

Telegram verbose raw-update logging writes private Telegram chat payload fields into gateway logs.

Root Cause

Impact and severity

Affected: Telegram channel users with verbose/debug gateway logs enabled. Severity: High data risk. Frequency: Observed on each raw Telegram update log line in the supplied evidence. Consequence: Gateway logs become unsafe to share because they can contain private chat payloads, user/chat identifiers, names, usernames, message text, and URLs.

Fix Action

Fixed

Code Example

Trace/proof from local evidence:
- gateway-dev.log contained 8 lines matching "telegram update:".
- Redacted examples showed `gateway/channels/telegram/raw-update` JSON previews containing fields such as:
  "message.from.id", "message.from.username", "message.chat.id", "message.text", "message.entities", and "link_preview_options.url".
- Current source before the fix serialized `ctx.update` directly in `extensions/telegram/src/bot-core.ts` when verbose logging was enabled.
RAW_BUFFERClick to expand / collapse

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

Telegram verbose raw-update logging writes private Telegram chat payload fields into gateway logs.

Steps to reproduce

  1. Start the Telegram channel with verbose/debug logging enabled.
  2. Receive a Telegram update that includes a private message payload.
  3. Inspect gateway logs for gateway/channels/telegram/raw-update entries.

Expected behavior

Verbose Telegram raw-update logs should preserve useful update shape while redacting private user/chat identifiers, names, usernames, message text, callback data, and URLs.

Actual behavior

The raw-update logger serializes ctx.update directly, so verbose/debug logs can include private Telegram user IDs, names, usernames, chat IDs, message text, and URLs.

OpenClaw version

NOT_ENOUGH_INFO

Operating system

NOT_ENOUGH_INFO

Install method

NOT_ENOUGH_INFO

Model

NOT_ENOUGH_INFO

Provider / routing chain

NOT_ENOUGH_INFO

Additional provider/model setup details

NOT_ENOUGH_INFO

Logs, screenshots, and evidence

Trace/proof from local evidence:
- gateway-dev.log contained 8 lines matching "telegram update:".
- Redacted examples showed `gateway/channels/telegram/raw-update` JSON previews containing fields such as:
  "message.from.id", "message.from.username", "message.chat.id", "message.text", "message.entities", and "link_preview_options.url".
- Current source before the fix serialized `ctx.update` directly in `extensions/telegram/src/bot-core.ts` when verbose logging was enabled.

Impact and severity

Affected: Telegram channel users with verbose/debug gateway logs enabled. Severity: High data risk. Frequency: Observed on each raw Telegram update log line in the supplied evidence. Consequence: Gateway logs become unsafe to share because they can contain private chat payloads, user/chat identifiers, names, usernames, message text, and URLs.

Additional information

The public report intentionally omits unredacted local gateway log lines because they include private Telegram payload content.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Verbose Telegram raw-update logs should preserve useful update shape while redacting private user/chat identifiers, names, usernames, message text, callback data, and URLs.

#generation error#database connection#vector store#embedding generation#cache error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - 💡(How to fix) Fix [Bug]: Telegram raw-update verbose logging includes private chat payloads [1 pull requests]