go-pkgz / notify / 33012843640

96%

master: 97%

Pull #45

github

Make the Telegram API base URL settable, and close what that opens

The bot API host was fixed at api.telegram.org, reachable only through an
unexported field the package's own tests set. Two consequences: an operator
behind a proxy had no way in, and the Telegram notifier was unreachable from
any test unwilling to talk to the live API.

remark42 hit the second one. Its Telegram auth now points at a stub through
go-pkgz/auth, which gained the same option, but the notify service still
reaches the public API, and the update dispatcher takes its requester from
that service, so the subscription flow cannot be covered by a browser test at
all.

APIURL takes the base and the "bot" segment is appended here, so a caller
passes https://proxy.example.com and requests come out as
https://proxy.example.com/bot<token>/<method>, matching what Telegram serves
and what go-pkgz/auth's own option accepts.

Moving a token-bearing URL across a boundary that used to be frozen is what
the rest of this is for.

The base is validated rather than trimmed. "https://api.telegram.org@evil.tld"
is a valid URL whose host is evil.tld, and every request built from the base
carries the bot token in its path, so it would ship the token there. Absolute
http or https, host required, no userinfo, query, fragment or opaque part; a
path prefix is allowed for a proxy mounted under one. No rejection echoes the
value, since it is configuration that can carry credentials in its userinfo or
a secret where the port belongs, and the parse error is dropped rather than
wrapped because *url.Error prints the URL it was given.

Errors are scrubbed of the token itself, not only of *url.Error's URL field.
The upstream decides an API error's text, and parseError interpolated its
description raw, so something standing in for Telegram could echo the request
URI back and put the token in a caller's log. The scrub covers the raw and
encoded forms and then checks a decoded copy, withholding the text when the
... (continued)

79 of 85 new or added lines in 1 file covered. (92.94%)

577 of 599 relevant lines covered (96.33%)

165.68 hits per line