fix(core): restrict send_message_to_user to current session (security fix #7822)

[Soulter]

Description

This PR fixes a high-security vulnerability (Issue #7822) in the send_message_to_user tool.

The Problem

The tool previously accepted a user-controlled session parameter, allowing any regular user to ask the LLM to send arbitrary messages to any group chat by crafting a target session string (e.g., KevinBot:GroupMessage:704943246). This is a severe security risk — attackers could send untrusted links/messages to any session.

The Fix

1. Removed the session parameter from the tool's parameter schema — the LLM can no longer propose it.
2. Hardcoded the target session to context.context.event.unified_msg_origin — always uses the current user's own session.
3. Updated the tool description to clearly state that it can only send messages to the current user's session.

Changes

• astrbot/core/tools/message_tools.py: +9/-7 lines

Security Audit

Also verified that no other built-in tools (e.g., cron_tools.py) have similar session injection vulnerabilities.

Closes #7822

Summary by Sourcery

Restrict the send_message_to_user tool to only send messages to the current user session to address a security vulnerability.

Bug Fixes:

• Fix a security issue where send_message_to_user could be used to send messages to arbitrary sessions by removing the user-controlled session parameter and always targeting the current session.

Documentation:

• Clarify the send_message_to_user tool description to state that it only sends messages to the current user's session and cannot target other sessions.

[sourcery-ai]

Hey - I've left some high level feedback:

• Consider adding a guard for context.context.event.unified_msg_origin being None or missing so the tool fails explicitly instead of passing an invalid session downstream in non-interactive contexts (e.g., cron-like triggers).
• The description still suggests use in cron-job-like scenarios; if such jobs don’t naturally have a unified_msg_origin, it may be worth clarifying how/if this tool can be used there now that the session is hardcoded to the triggering user.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Consider adding a guard for `context.context.event.unified_msg_origin` being `None` or missing so the tool fails explicitly instead of passing an invalid session downstream in non-interactive contexts (e.g., cron-like triggers).
- The description still suggests use in cron-job-like scenarios; if such jobs don’t naturally have a `unified_msg_origin`, it may be worth clarifying how/if this tool can be used there now that the session is hardcoded to the triggering user.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[gemini-code-assist]

Code Review

This pull request addresses a security vulnerability in the SendMessageToUserTool by removing the optional session parameter, ensuring messages are only sent to the current user's session. The tool's description and logic were updated to enforce this restriction. Feedback suggests adding a validation check to handle cases where the session origin might be unavailable, providing a clearer error message.