#23724: fix(security): sanitize RPC error messages in signal and imessage clients
channel: imessage
channel: signal
size: XS
Cluster:
OpenClaw Plugin Enhancements
## Summary
- Problem: Signal and iMessage RPC clients include raw upstream error messages verbatim in thrown errors, risking information disclosure (CWE-209)
- Why it matters: RPC error messages from external processes may contain internal paths, connection details, or other sensitive data that should not propagate through error handling chains
- What changed: Added type guards and length truncation (200 chars) to RPC error messages before including them in thrown errors
- What did NOT change: Error codes are still forwarded; error handling flow is unchanged
## Change Type
- [x] Security hardening
## Scope
- [x] Integrations
## Security Impact
- New permissions/capabilities? No
- Secrets/tokens handling changed? No
- New/changed network calls? No
- Command/tool execution surface changed? No
- Data access scope changed? No
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- greptile_comment -->
<h3>Greptile Summary</h3>
Added type guards and 200-character truncation to RPC error messages in Signal and iMessage clients to prevent information disclosure (CWE-209). Raw error messages from external RPC processes are now sanitized before being included in thrown errors, preventing leakage of internal paths, connection details, or other sensitive data through error handling chains.
<h3>Confidence Score: 5/5</h3>
- This PR is safe to merge with minimal risk
- The changes are focused, follow existing patterns in the codebase (200-char truncation is used in 20+ files), properly handle edge cases with type guards, and address a real security concern without changing error handling flow or breaking existing functionality
- No files require special attention
<sub>Last reviewed commit: 0acf61b</sub>
<!-- greptile_other_comments_section -->
<!-- /greptile_comment -->
Most Similar PRs
#4784: fix(imessage): handle non-JSON output from imsg CLI gracefully
by spiceoogway · 2026-01-30
74.9%
#10709: fix(signal): guard JSON.parse against malformed RPC responses
by Yida-Dev · 2026-02-06
74.4%
#2744: FIX(imessage): preserve signal info in RPC close handler
by sal-jim · 2026-01-27
72.7%
#23161: fix(imessage): parse permission denied errors from imsg rpc plainte...
by NewdlDewdl · 2026-02-22
72.4%
#21159: fix(security): harden data exposure controls
by novalis133 · 2026-02-19
72.2%
#12984: fix(signal): fall back to JSON-RPC for health check on signal-cli 0...
by omair445 · 2026-02-10
72.0%
#16708: fix(security): OC-17 add token redaction to error formatting, depre...
by aether-ai-agent · 2026-02-15
71.8%
#5649: fix(security): harden file permissions and header merging
by sfo2001 · 2026-01-31
71.7%
#18970: Fix #18937: Don't leak API errors to user channel
by jwchmodx · 2026-02-17
71.3%
#18924: fix(security): tighten permissions on cron/, browser/, settings/ dirs…
by rexlunae · 2026-02-17
71.3%