go-pkgz / auth / 32644154072

87%

master: 86%

Pull #316

github

Close three more routes the bot token can take out of the process

An adversarial pass over the base-URL feature found that pointing the API at a
caller-supplied host widens more than the request destination, because the
answers now come from a host the library does not control.

BotInfo returned whatever the upstream put in result.username, and
LoginHandler hands that to an unauthenticated caller in its "bot" field. An
upstream echoing the request URI would therefore publish the bot token through
a public endpoint. The username now has to match Telegram's own shape before it
is accepted.

tokenRecoverable decoded once, so a double-encoded echo came back as a
single-encoded one and stayed just as readable. It now decodes until the text
stops changing, with a cap.

validateTelegramBaseURL checked u.Host, which is non-empty for "http://:9000",
an unspecified remote that resolves to the local machine. It checks Hostname now.

Also routes the two transport-error paths in request through redactToken as
well as the shape regex, since the regex only matches a token sitting inside a
/bot.../ path segment.

Each fix has a test in both modules, and each is mutation-checked: removing the
username check, weakening Hostname back to Host, and reducing the decode loop
to one pass each fail their own test and nothing else.

96 of 106 new or added lines in 1 file covered. (90.57%)

3272 of 3785 relevant lines covered (86.45%)

9.63 hits per line