{"record":{"id":"3afd2d6199c09503","repo":"affaan-m/ECC","slug":"invalid-interaction-id-token","errorCode":null,"errorMessage":"invalid interaction id/token","messagePattern":"invalid interaction id/token","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"scripts/discord/ecc-bot.mjs","lineNumber":45,"sourceCode":"const API = 'https://discord.com/api/v10';\n\n// Strip CR/LF from string args so Discord-payload-controlled values (command\n// names, usernames) cannot forge or inject extra log lines (log injection).\nconst log = (...a) =>\n  console.log(new Date().toISOString(), ...a.map(x => (typeof x === 'string' ? x.replace(/[\\r\\n]+/g, ' ') : x)));\n\n// Interaction ids are Discord snowflakes (numeric) and tokens are a bounded\n// URL-safe set. Validate before building the callback URL so a malformed or\n// hostile gateway payload cannot inject path segments / alter the request\n// target (SSRF). The host is always the fixed API constant.\nconst SNOWFLAKE_RE = /^[0-9]{1,20}$/;\nconst INTERACTION_TOKEN_RE = /^[A-Za-z0-9._-]{1,255}$/;\n\nfunction interactionCallbackUrl(interaction) {\n  const id = String(interaction?.id ?? '');\n  const token = String(interaction?.token ?? '');\n  if (!SNOWFLAKE_RE.test(id) || !INTERACTION_TOKEN_RE.test(token)) {\n    throw new Error('invalid interaction id/token');\n  }\n  return `${API}/interactions/${id}/${token}/callback`;\n}\n\n// Clamp a remote-supplied timer interval to a sane range so a hostile/bogus\n// heartbeat_interval cannot spin a tight loop or hang the bot (resource\n// exhaustion). Discord's real value is ~41250ms.\nfunction clampHeartbeatInterval(value) {\n  const n = Number(value);\n  if (!Number.isFinite(n)) return 41250;\n  return Math.max(1000, Math.min(n, 600000));\n}\n\n// ---------- skill + docs lookup (local clone as the data source) ----------\n\nfunction parseFrontmatter(text) {\n  const m = text.match(/^---\\n([\\s\\S]*?)\\n---/);\n  if (!m) return {};","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/affaan-m/ECC/blob/06c5e118c4d3e6c3b7f9445f973a2194c82de193/scripts/discord/ecc-bot.mjs#L27-L63","documentation":"SSRF/path-injection guard in the Discord bot: interaction ids must be numeric snowflakes and tokens from a bounded URL-safe set, validated before the interaction callback URL is built, so a hostile gateway payload cannot alter the request target.","triggerScenarios":"Triggered when ecc-bot.mjs rejects the current invocation: invalid interaction id/token","commonSituations":"Occurs while running scripts/discord/ecc-bot.mjs with invalid arguments, missing flags, or a failing external dependency; the guard at scripts/discord/ecc-bot.mjs:45 aborts the command with this message.","solutions":["Correct the value to one of the accepted options listed in the error message."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"06c5e118c4d3e6c3b7f9445f973a2194c82de193","analyzedAt":"2026-08-18T11:27:13.915Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}