go-pkgz / notify
96%

DEFAULT BRANCH: master
Repo Added
Token CNqoBqbWV2Qy4tV0656LK6KQcShi75XCE regen
Build 169 Last
Files 5
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH master
branch: master
CHANGE BRANCH
x
Sync Branches

coverage: 96.327% (-0.2%) from 96.538%
33223227627

push

github

web-flow 
Make the Telegram API base URL settable, and close what that opens (#45)

The bot API host was fixed at api.telegram.org, reachable only through an
unexported field the package's own tests set. Two consequences: an operator
behind a proxy had no way in, and the Telegram notifier was unreachable from
any test unwilling to talk to the live API.

remark42 hit the second one. Its Telegram auth now points at a stub through
go-pkgz/auth, which gained the same option, but the notify service still
reaches the public API, and the update dispatcher takes its requester from
that service, so the subscription flow cannot be covered by a browser test at
all.

APIURL takes the base and the "bot" segment is appended here, so a caller
passes https://proxy.example.com and requests come out as
https://proxy.example.com/bot<token>/<method>, matching what Telegram serves
and what go-pkgz/auth's own option accepts.

Moving a token-bearing URL across a boundary that used to be frozen is what
the rest of this is for.

The base is validated rather than trimmed. "https://api.telegram.org@evil.tld"
is a valid URL whose host is evil.tld, and every request built from the base
carries the bot token in its path, so it would ship the token there. Absolute
http or https, host required, no userinfo, query, fragment or opaque part; a
path prefix is allowed for a proxy mounted under one. No rejection echoes the
value, since it is configuration that can carry credentials in its userinfo or
a secret where the port belongs, and the parse error is dropped rather than
wrapped because *url.Error prints the URL it was given.

Errors are scrubbed of the token itself, not only of *url.Error's URL field.
The upstream decides an API error's text, and parseError interpolated its
description raw, so something standing in for Telegram could echo the request
URI back and put the token in a caller's log. The scrub covers the raw and
encoded forms and then checks a decoded copy, withholding the text whe... (continued)

79 of 85 new or added lines in 1 file covered. (92.94%)

577 of 599 relevant lines covered (96.33%)

176.07 hits per line

Relevant lines Covered
599 RELEVANT LINES 577 COVERED LINES
176.07 HITS PER LINE
Source Files on master

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
33223227627 master Make the Telegram API base URL settable, and close what that opens (#45) The bot API host was fixed at api.telegram.org, reachable only through an unexported field the package's own tests set. Two consequences: an operator behind a proxy had no w... push web-flow github
96.33
32222053719 master feat: add configurable SMTP HELO hostname (#38) * feat: add configurable SMTP HELO hostname * Cover the HELO hostname with tests Test asserts the greeting hostname reported by the sender, so it fails if the option stops being passed through, an... push web-flow github
96.54
32221541560 master Terminate email send on context cancellation (#41) Context was checked once before the send, and the sender applied its timeout to the connection setup only, so a server accepting the connection and stalling afterwards blocked Send with no way ou... push web-flow github
96.13
32218465235 master Cover the HELO hostname with tests Test asserts the greeting hostname reported by the sender, so it fails if the option stops being passed through, and pins the default to localhost for callers not setting the field. README example gets the field... Pull #38 paskal github
96.15
32209750644 master chore: update go-pkgz/email to v0.8.0 and lgr to v0.12.4 push umputun github
96.12
32202981223 master Point go-pkgz/email at master until the release is tagged Picks up the SendContext work merged after v0.7.0, so this branch builds against what the release will carry. Pseudo-version has to be replaced with the tag once it is out. Pull #38 paskal github
96.15
32195443752 master Make telegram auth state changes single-writer (#40) Auth requests were read under a read lock, changed on a copy and written back later, so a request consumed by CheckToken in between was restored from the stale copy and could be used again. Con... push web-flow github
96.51
32195201290 master Fix secret leaks and HTTP handling in notifiers (#39) * Stop leaking bot token and shared connections in telegram requests Token is a part of every API URL, so any transport failure returns *url.Error with the token in it, and callers logging th... push web-flow github
96.02
32188839255 master Bump go-pkgz/email to v0.7.0 and cover the HELO hostname HELOHost option lives in go-pkgz/email v0.7.0, with the dependency pinned to v0.6.0 the package didn't build. Test asserts the greeting hostname reported by the sender, which fails if the ... Pull #38 paskal github
96.74
28463098554 master Merge pull request #37 from go-pkgz/fix/deps-security-go1.25 Update dependencies to latest and bump to go 1.25 push web-flow github
96.31
See All Builds (141)