go-pkgz / auth / 32644231611

87%

master: 86%

Pull #316

github

Refuse redirects on requests that carry the bot token

Go copies the previous URL into Referer on every redirect hop except
https-to-http, and both Telegram URL forms carry the token in the path, so a
redirect hands the destination host the bot token, normally into its access
log. Verified against net/http rather than inferred: a probe with two TLS test
servers shows the target receiving
Referer: https://host/bot1234567:SECRET-TOK/getMe.

The public API does not redirect, so nothing legitimate is lost by refusing,
and a caller-supplied base is exactly where an unexpected redirect could come
from. noRedirect takes a shallow copy of the client so the caller's own is left
alone and its Transport, and with it any custom CA, client certificate or proxy
setting, is still used. Applied to the bot-method path and to the avatar
download, which carries the token in its URL too.

Worth an explicit decision on your side: this makes a proxy that answers with a
redirect stop working, where before it worked and leaked. Refusing is the safer
default, and it is a one-line change to make it configurable if you would
rather it were.

95 of 106 new or added lines in 1 file covered. (89.62%)

3312 of 3828 relevant lines covered (86.52%)

9.78 hits per line