affaan-m/ECC · error

invalid interaction id/token

Error message

invalid interaction id/token

What it means

SSRF/path-injection guard in the Discord bot: interaction ids must be numeric snowflakes and tokens from a bounded URL-safe set, validated before the interaction callback URL is built, so a hostile gateway payload cannot alter the request target.

Source

Thrown at scripts/discord/ecc-bot.mjs:45

const API = 'https://discord.com/api/v10';

// Strip CR/LF from string args so Discord-payload-controlled values (command
// names, usernames) cannot forge or inject extra log lines (log injection).
const log = (...a) =>
  console.log(new Date().toISOString(), ...a.map(x => (typeof x === 'string' ? x.replace(/[\r\n]+/g, ' ') : x)));

// Interaction ids are Discord snowflakes (numeric) and tokens are a bounded
// URL-safe set. Validate before building the callback URL so a malformed or
// hostile gateway payload cannot inject path segments / alter the request
// target (SSRF). The host is always the fixed API constant.
const SNOWFLAKE_RE = /^[0-9]{1,20}$/;
const INTERACTION_TOKEN_RE = /^[A-Za-z0-9._-]{1,255}$/;

function interactionCallbackUrl(interaction) {
  const id = String(interaction?.id ?? '');
  const token = String(interaction?.token ?? '');
  if (!SNOWFLAKE_RE.test(id) || !INTERACTION_TOKEN_RE.test(token)) {
    throw new Error('invalid interaction id/token');
  }
  return `${API}/interactions/${id}/${token}/callback`;
}

// Clamp a remote-supplied timer interval to a sane range so a hostile/bogus
// heartbeat_interval cannot spin a tight loop or hang the bot (resource
// exhaustion). Discord's real value is ~41250ms.
function clampHeartbeatInterval(value) {
  const n = Number(value);
  if (!Number.isFinite(n)) return 41250;
  return Math.max(1000, Math.min(n, 600000));
}

// ---------- skill + docs lookup (local clone as the data source) ----------

function parseFrontmatter(text) {
  const m = text.match(/^---\n([\s\S]*?)\n---/);
  if (!m) return {};

View on GitHub (pinned to 06c5e118c4)

Solutions

1. Correct the value to one of the accepted options listed in the error message.

When it happens

Trigger: Triggered when ecc-bot.mjs rejects the current invocation: invalid interaction id/token

Common situations: Occurs while running scripts/discord/ecc-bot.mjs with invalid arguments, missing flags, or a failing external dependency; the guard at scripts/discord/ecc-bot.mjs:45 aborts the command with this message.

AI-assisted analysis of affaan-m/ECC@06c5e118c4 (2026-08-18). Data as JSON: /api/errors/3afd2d6199c09503. Report an issue: GitHub.