Skip to content

fix: HONEYPOT_MARKER for honeypot message #34

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Nivmizz7 merged 1 commit into from
Jul 13, 2026
+1 −1
Merged

fix: HONEYPOT_MARKER for honeypot message #34

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/handlers/honeypotHandler.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ const HONEYPOT_CHANNEL_ID = process.env.HONEYPOT_CHANNEL_ID;

// Stable marker embedded in the bot's warning message so we can detect it
// across restarts without persisting state.
const HONEYPOT_MARKER = "<!-- trackerbot-honeypot-message -->";
const HONEYPOT_MARKER = "TrackerBot Honeypot";

@codeant-ai codeant-ai Bot Jul 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: The marker value is too generic for a substring-based detector. Because the code later treats any bot message whose content includes this marker as the protected honeypot warning, another bot posting this phrase will be mistaken as the canonical warning, which can suppress warning creation and prevent cleanup deletion for that message. Use a highly unique/unguessable marker string (and ideally pair detection with the expected bot author) to avoid false positives. [logic error]

Severity Level: Major ⚠️ 
- ❌ Honeypot warning missing when other bot posts marker.
- ⚠️ Old bot message preserved, interfering with honeypot cleanup.
- ⚠️ Misclassified message weakens honeypot reliability and safety.
Steps of Reproduction ✅ 
1. Start the Discord bot using `bot.js:1-29`, with `HONEYPOT_CHANNEL_ID` set and
`setupHoneypot(client)` called at `bot.js:27`, which in turn registers honeypot behavior
via `setupHoneypot` in `src/handlers/honeypotHandler.js:24-74`.

2. In the honeypot channel whose ID matches `HONEYPOT_CHANNEL_ID`
(`honeypotHandler.js:8`), have a different bot (any Discord bot account other than this
TrackerBot client) send a message whose `content` includes the literal phrase `"TrackerBot
Honeypot"` (the marker defined at `honeypotHandler.js:12`), for example `"TrackerBot
Honeypot test message"`.

3. On `ClientReady`, `setupHoneypot` calls `ensureHoneypotMessage(channel)` at
`honeypotHandler.js:37`. Inside `ensureHoneypotMessage` (`honeypotHandler.js:78-85`), the
code iterates pages from `fetchMessagePages` and checks `messages.some(msg =>
msg.author.bot && msg.content?.includes(HONEYPOT_MARKER))` at `honeypotHandler.js:80`.
Because the other bot’s message satisfies `msg.author.bot` and
`msg.content.includes("TrackerBot Honeypot")`, the function returns early at
`honeypotHandler.js:81` without sending the actual honeypot warning
(`channel.send(HONEYPOT_WARNING)` at `honeypotHandler.js:84` is skipped).

4. Later, when periodic cleanup runs via `cleanupOldMessages(channel)` from the interval
in `setupHoneypot` (`honeypotHandler.js:40-45`), the filter at `honeypotHandler.js:93-96`
computes `toDelete` as messages older than 16h where NOT `(msg.author.bot &&
msg.content?.includes(HONEYPOT_MARKER))`. The unrelated bot’s message is preserved because
it matches the marker condition, causing it to be treated as the protected honeypot
warning even though it was not authored by the TrackerBot client and may be arbitrary
content. This demonstrates that any bot message containing the generic marker substring is
misclassified as the honeypot warning, affecting warning creation and cleanup behavior.

Fix in Cursor Fix in VSCode Claude

(Use Cmd/Ctrl + Click for best experience)

Prompt for AI Agent 🤖 
This is a comment left during a code review.

**Path:** src/handlers/honeypotHandler.js
**Line:** 12:12
**Comment:**
	*Logic Error: The marker value is too generic for a substring-based detector. Because the code later treats any bot message whose content includes this marker as the protected honeypot warning, another bot posting this phrase will be mistaken as the canonical warning, which can suppress warning creation and prevent cleanup deletion for that message. Use a highly unique/unguessable marker string (and ideally pair detection with the expected bot author) to avoid false positives.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
👍 | 👎


const HONEYPOT_WARNING = `${HONEYPOT_MARKER}\n# ⛔️⚠️ DO NOT SEND MESSAGES HERE, YOU WILL BE BANNED INSTANTLY ⚠️⛔️`;

Expand Down
Loading