go-pkgz / auth / 32644231589

87%

master: 86%

Build Type

Pull #316

github

Committed by paskal

Commit Message

Refuse redirects on requests that carry the bot token

Go copies the previous URL into Referer on every redirect hop except
https-to-http, and both Telegram URL forms carry the token in the path, so a
redirect hands the destination host the bot token, normally into its access
log. Verified against net/http rather than inferred: a probe with two TLS test
servers shows the target receiving
Referer: https://host/bot1234567:SECRET-TOK/getMe.

The public API does not redirect, so nothing legitimate is lost by refusing,
and a caller-supplied base is exactly where an unexpected redirect could come
from. noRedirect takes a shallow copy of the client so the caller's own is left
alone and its Transport, and with it any custom CA, client certificate or proxy
setting, is still used. Applied to the bot-method path and to the avatar
download, which carries the token in its URL too.

Worth an explicit decision on your side: this makes a proxy that answers with a
redirect stop working, where before it worked and leaked. Refusing is the safer
default, and it is a one-line change to make it configurable if you would
rather it were.

Pull Request Pull Request #316: Allow pointing the Telegram provider at another API base URL

Coverage Stats

95 of 106 new or added lines in 1 file covered. (89.62%)

15 existing lines in 1 file now uncovered.

3281 of 3794 relevant lines covered (86.48%)

9.7 hits per line