go-pkgz / auth
85%
master: 85%

LAST BUILD BRANCH: fix/auth-sensitive-logging
DEFAULT BRANCH: master
Repo Added
Files 25
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH fix/telegram-redact-bot-token-in-avatar-url
branch: fix/telegram-redact-bot-token-in-avatar-url
CHANGE BRANCH
x

coverage: 84.897% (+0.03%) from 84.872%
25587623060

Pull #286

github

paskal 
fix(telegram): never expose bot token in avatar URL

tgAPI.Avatar returned a URL with the bot token embedded in its path:

    https://api.telegram.org/file/bot{TOKEN}/photos/file_X.jpg

The token is a bearer credential for the entire bot API. The URL flowed
into User.Picture and from there:

* Into avatar.Proxy.Put debug logs ("[DEBUG] saved avatar from <url>"
  and the corresponding load-failure line) regardless of whether avatar
  saving succeeded.
* Into the JWT claims and the user JSON returned to the browser when
  no AvatarSaver was configured (User.Picture is in the User struct).

Either path leaks the bot token to anyone with log access, anyone who
can read the JWT (the user themselves on the device, plus anyone
intercepting browser/devtools), or any third-party observability stack.

Two-part fix in v1 and v2:

1. avatar/avatar.go: redact the URL in Put's two debug log lines via a
   new redactAvatarURL helper (hostname only). Add Proxy.PutContent so
   pre-fetched bytes can be saved without the URL-fetch round trip.
2. provider/telegram.go: in processUpdates, never assign the bot URL
   to User.Picture. Pass it to a new saveTelegramAvatar method that
   fetches the bytes server-side and stores them via the new content-
   saver interface (avatar.Proxy implements it). The call returns a
   clean local proxy URL or "" — whatever lands in Picture is safe to
   log and to send to the client.

A graceful fallback path warns and drops the avatar when the
configured AvatarSaver does not implement PutContent (custom external
implementations) — never exposes the token to satisfy the avatar
feature.

Tests in both modules:

* TestSaveTelegramAvatar_BotTokenNeverLogged — unit-level table for
  the helper covering the success, fallback-without-PutContent and
  empty-URL paths.
* TestTelegramProcessUpdates_BotTokenNeverInUserPicture — regression
  test for the property: drive processUpdates with a mock that returns
  a URL containing a bot-token marker; ... (continued)
Pull Request #286: fix(telegram): never expose bot token in avatar URL

79 of 96 new or added lines in 2 files covered. (82.29%)

2895 of 3410 relevant lines covered (84.9%)

7.73 hits per line

Relevant lines Covered
3410 RELEVANT LINES 2895 COVERED LINES
7.73 HITS PER LINE
Source Files on fix/telegram-redact-bot-token-in-avatar-url

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
25587623060 fix/telegram-redact-bot-token-in-avatar-url fix(telegram): never expose bot token in avatar URL tgAPI.Avatar returned a URL with the bot token embedded in its path: https://api.telegram.org/file/bot{TOKEN}/photos/file_X.jpg The token is a bearer credential for the entire bot API. The... Pull #286 paskal github
84.9
25587623051 fix/telegram-redact-bot-token-in-avatar-url fix(telegram): never expose bot token in avatar URL tgAPI.Avatar returned a URL with the bot token embedded in its path: https://api.telegram.org/file/bot{TOKEN}/photos/file_X.jpg The token is a bearer credential for the entire bot API. The... Pull #286 paskal github
84.5
25587624203 fix/telegram-redact-bot-token-in-avatar-url fix(telegram): never expose bot token in avatar URL tgAPI.Avatar returned a URL with the bot token embedded in its path: https://api.telegram.org/file/bot{TOKEN}/photos/file_X.jpg The token is a bearer credential for the entire bot API. The... Pull #286 paskal github
84.5
25587445722 fix/telegram-redact-bot-token-in-avatar-url fix(telegram): never expose bot token in avatar URL tgAPI.Avatar returned a URL with the bot token embedded in its path: https://api.telegram.org/file/bot{TOKEN}/photos/file_X.jpg The token is a bearer credential for the entire bot API. The... Pull #286 paskal github
84.92
25587445700 fix/telegram-redact-bot-token-in-avatar-url fix(telegram): never expose bot token in avatar URL tgAPI.Avatar returned a URL with the bot token embedded in its path: https://api.telegram.org/file/bot{TOKEN}/photos/file_X.jpg The token is a bearer credential for the entire bot API. The... Pull #286 paskal github
84.53
25586522059 fix/telegram-redact-bot-token-in-avatar-url fix(telegram): never expose bot token in avatar URL tgAPI.Avatar returned a URL with the bot token embedded in its path: https://api.telegram.org/file/bot{TOKEN}/photos/file_X.jpg The token is a bearer credential for the entire bot API. The... Pull #286 paskal github
84.58
25586522063 fix/telegram-redact-bot-token-in-avatar-url fix(telegram): never expose bot token in avatar URL tgAPI.Avatar returned a URL with the bot token embedded in its path: https://api.telegram.org/file/bot{TOKEN}/photos/file_X.jpg The token is a bearer credential for the entire bot API. The... Pull #286 paskal github
84.97
25586522986 fix/telegram-redact-bot-token-in-avatar-url fix(telegram): never expose bot token in avatar URL tgAPI.Avatar returned a URL with the bot token embedded in its path: https://api.telegram.org/file/bot{TOKEN}/photos/file_X.jpg The token is a bearer credential for the entire bot API. The... Pull #286 paskal github
84.58
25586123478 fix/telegram-redact-bot-token-in-avatar-url fix(telegram): never expose bot token in avatar URL tgAPI.Avatar returned a URL with the bot token embedded in its path: https://api.telegram.org/file/bot{TOKEN}/photos/file_X.jpg The token is a bearer credential for the entire bot API. The... Pull #286 paskal github
84.79
25586123468 fix/telegram-redact-bot-token-in-avatar-url fix(telegram): never expose bot token in avatar URL tgAPI.Avatar returned a URL with the bot token embedded in its path: https://api.telegram.org/file/bot{TOKEN}/photos/file_X.jpg The token is a bearer credential for the entire bot API. The... Pull #286 paskal github
84.39
See All Builds (1088)