Signal: harden E.164 validation

src/channels/plugins/onboarding/signal.test.ts

@@ -1,5 +1,4 @@
 import { describe, expect, it } from "vitest";
-
 import { normalizeSignalAccountInput } from "./signal.js";
 
 describe("normalizeSignalAccountInput", () => {
@@ -20,6 +19,11 @@ describe("normalizeSignalAccountInput", () => {
     expect(normalizeSignalAccountInput("++--")).toBeNull();
   });
 
+  it("rejects inputs with stray + characters", () => {
+    expect(normalizeSignalAccountInput("++12345")).toBeNull();
+    expect(normalizeSignalAccountInput("+1+2345")).toBeNull();
+  });
+
   it("rejects numbers that are too short or too long", () => {
     expect(normalizeSignalAccountInput("+1234")).toBeNull();
     expect(normalizeSignalAccountInput("+1234567890123456")).toBeNull();

src/channels/plugins/onboarding/signal.ts

@@ -18,6 +18,7 @@ import { addWildcardAllowFrom, promptAccountId } from "./helpers.js";
 const channel = "signal" as const;
 const MIN_E164_DIGITS = 5;
 const MAX_E164_DIGITS = 15;
+const DIGITS_ONLY = /^\d+$/;
 const INVALID_SIGNAL_ACCOUNT_ERROR =
   "Invalid E.164 phone number (must start with + and country code, e.g. +15555550123)";
 
@@ -28,10 +29,13 @@ export function normalizeSignalAccountInput(value: string | null | undefined): s
   }
   const normalized = normalizeE164(trimmed);
   const digits = normalized.slice(1);
+  if (!DIGITS_ONLY.test(digits)) {
+    return null;
+  }
   if (digits.length < MIN_E164_DIGITS || digits.length > MAX_E164_DIGITS) {
     return null;
   }
-  return normalized;
+  return `+${digits}`;
 }
 
 function setSignalDmPolicy(cfg: OpenClawConfig, dmPolicy: DmPolicy) {
@@ -273,7 +277,9 @@ export const signalOnboardingAdapter: ChannelOnboardingAdapter = {
           message: `Signal account set (${account}). Keep it?`,
           initialValue: true,
         });
-        if (!keep) account = "";
+        if (!keep) {
+          account = "";
+        }
       }
     }