openclaw - 💡(How to fix) Fix Bug: WhatsApp encrypted media temp files not cleaned up on failure [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#54297Fetched 2026-04-08 01:29:23
View on GitHub
Comments
0
Participants
1
Timeline
0
Reactions
0

WhatsApp media handling (Baileys library integration) creates temp files in os.tmpdir() for encrypted media. If upload fails after file creation, encrypted media files persist indefinitely in /tmp/.

The encryptedStream function creates both encFilePath and originalFilePath without guaranteed cleanup in finally blocks.

File names use generateMessageIDV2() (not cryptographic random).

Root Cause

WhatsApp media handling (Baileys library integration) creates temp files in os.tmpdir() for encrypted media. If upload fails after file creation, encrypted media files persist indefinitely in /tmp/.

The encryptedStream function creates both encFilePath and originalFilePath without guaranteed cleanup in finally blocks.

File names use generateMessageIDV2() (not cryptographic random).

RAW_BUFFERClick to expand / collapse

Summary

WhatsApp media handling (Baileys library integration) creates temp files in os.tmpdir() for encrypted media. If upload fails after file creation, encrypted media files persist indefinitely in /tmp/.

The encryptedStream function creates both encFilePath and originalFilePath without guaranteed cleanup in finally blocks.

File names use generateMessageIDV2() (not cryptographic random).

Impact

  • Sensitive media content persists in world-readable /tmp/ directory
  • On shared systems, other users could access unencrypted media
  • No TTL or cleanup mechanism for orphaned files

Location

dist/session-BFZksknu.js:81734, 81948-81990

Suggested Fix

  1. Use mkdtemp for temp directories
  2. Implement cleanup in finally blocks
  3. Use O_EXCL for file creation

extent analysis

Fix Plan

To address the issue of temporary files persisting in /tmp/, we will implement the following steps:

  • Create a temporary directory using mkdtemp to store encrypted media files.
  • Ensure cleanup of temporary files in finally blocks.
  • Use O_EXCL for file creation to prevent overwrite attacks.

Example Code

const fs = require('fs');
const os = require('os');
const path = require('path');
const { promisify } = require('util');
const mkdtemp = promisify(require('fs').mkdtemp);

// Create a temporary directory
async function createTempDir() {
  const tempDir = await mkdtemp(path.join(os.tmpdir(), 'whatsapp-media-'));
  return tempDir;
}

// Create a temporary file with exclusive creation
async function createTempFile(tempDir) {
  const tempFilePath = path.join(tempDir, `media-${generateMessageIDV2()}`);
  await promisify(fs.open)(tempFilePath, 'w', 0o600);
  return tempFilePath;
}

// Example usage
async function encryptedStream() {
  const tempDir = await createTempDir();
  try {
    const encFilePath = await createTempFile(tempDir);
    const originalFilePath = await createTempFile(tempDir);
    // Upload media files
  } finally {
    // Cleanup temporary files and directory
    await promisify(fs.rm)(tempDir, { recursive: true, force: true });
  }
}

Verification

To verify that the fix worked, you can:

  • Check the /tmp/ directory for any remaining temporary files after upload failure.
  • Use a tool like tmpreaper to monitor and clean up temporary files.
  • Test the encryptedStream function with upload failure scenarios to ensure cleanup occurs correctly.

Extra Tips

  • Consider implementing a TTL (time-to-live) mechanism for temporary files to ensure they are cleaned up after a certain period.
  • Use a secure random number generator for generating file names to prevent predictability attacks.
  • Regularly review and update the temporary file cleanup mechanism to prevent regressions.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING