ScuroNeko/Laniakea
1
1
Fork 0
Code Issues 1 Pull Requests Actions Packages Releases 27 Wiki Activity

(security): auto-generate webhook secret when unset, redact token in tgapi standalone logs (fix): webhookLogger nil panic, dead warning block (tests): update secret-path test for new auto-gen behaviour (doc): CHANGELOG v1.0.1

Browse Source 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
ScuroNeko
2026-06-11 13:33:34 +03:00
co-authored by Claude Sonnet 4.6
parent 5514665625
commit 9e3450df31
7 changed files with 42 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bot_webhook.go
+11 -6
View File
@@ -137,6 +137,15 @@ func (bot *Bot[T]) RunWebhookWithContext(ctx context.Context, opts *BotWebhookOp
if len(bot.plugins) == 0 {
return ErrNoPlugins
}
autoSecret := ""
if opts.SecretToken == "" {
rndSecret, err := generateToken(32)
if err != nil {
return err
}
opts.SecretToken = rndSecret
autoSecret = rndSecret
}
if opts.URL == "" {
return ErrNoBotWebhookOptsURL
}
@@ -146,9 +155,6 @@ func (bot *Bot[T]) RunWebhookWithContext(ctx context.Context, opts *BotWebhookOp
if err := validateWebhookPath(opts.Path, opts.UseStatusPath); err != nil {
return err
}
if opts.UseStatusPath && opts.SecretToken == "" {
return ErrStatusPathSecretRequired
}
if err := validateWebhookTLSFiles(tlsFiles); err != nil {
return err
}
@@ -158,10 +164,9 @@ func (bot *Bot[T]) RunWebhookWithContext(ctx context.Context, opts *BotWebhookOp
}
return bot.runWebhookRuntime(ctx, func(runCtx context.Context) error {
if opts.SecretToken == "" {
bot.webhookLogger.Warnln("Using webhook without secret is very dangerous. Anyone can simulate Telegram requests.")
if autoSecret != "" {
bot.webhookLogger.Warnln("Using webhook without secret is very dangerous. Using random 32 bytes token:", autoSecret)
}
i, err := bot.api.GetWebhookInfoWithContext(runCtx)
if err != nil {
return err