#14847: fix(slack): preserve auth across Slack-hosted file redirects

by natashache open 2026-02-12 18:15 View on GitHub →

channel: slack stale size: S

## Summary - keep `Authorization: Bearer ...` on every request to Slack-owned hosts (`*.slack.com`, `*.slack-edge.com`, `*.slack-files.com`) during media fetches - explicitly strip `Authorization` for non-Slack hosts to avoid token leakage - skip saving payloads that look like Slack login HTML pages (`text/html` content-type or HTML body prefix) ## Why Slack file URLs can redirect through multiple Slack-hosted endpoints before reaching media bytes. Previously auth was only sent on the first request, so later Slack hops could return sign-in HTML that got saved as media (for example as `.png`). ## Tests - `corepack pnpm vitest run src/slack/monitor/media.test.ts` - added test: keeps Authorization header for Slack-hosted redirect hops - added test: skips HTML login payloads instead of saving as media  <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> This PR updates Slack media fetching to preserve `Authorization: Bearer <token>` across redirect hops that stay on Slack-owned HTTPS hostnames, while explicitly stripping `Authorization` on non-Slack hosts to avoid token leakage. It also adds a guard in `resolveSlackMedia` to skip saving responses that look like Slack login HTML (via `text/html` content-type or a `<!doctype html` / `<html` body prefix), preventing accidental persistence of login pages as media. The accompanying tests extend `src/slack/monitor/media.test.ts` to cover Slack-hosted redirect hops retaining auth headers and to verify HTML/login payloads are ignored rather than saved. <h3>Confidence Score: 5/5</h3> - This PR is safe to merge with minimal risk. - Changes are narrowly scoped to Slack media fetching, preserve SSRF-guarded redirect handling, and add tests covering the new auth/HTML-skip behavior. No regressions or unsafe token propagation were found in the updated fetch wrapper logic. - No files require special attention  <sub>(2/5) Greptile learns from your feedback when you react with thumbs up/down!</sub>