mirror of
https://github.com/tiennm99/miti99bot.git
synced 2026-09-16 04:19:13 +00:00
tiennm99
939c5fedab
Phase 1+2 of the 2026-05-09 review remediation plan: - Go-version alignment (Dockerfile/go.mod) + 4 nil-deref guards + CI docker-build step (Phase 1, 63482c4 carried over). - Env allowlist: secretEnvKeys denylist replaced; modules opt-in via RequiredEnv. Future API keys do not auto-leak. - Visibility enforcement: dispatcher gates Private/Protected commands via BOT_OWNER_ID / ADMIN_USER_IDS; non-permitted callers are silently denied. - Panic recovery in webhook handler; logs runtime/debug.Stack and returns 200 to prevent Telegram retry storm. - Cron timeout reduced 5m -> 60s. - MaxBytesError handled separately from generic decode errors so 413 from MaxBytesReader is not shadowed by a 400. - Emoji clue HTML-escaped defensively in loldle-emoji renderer. - Tests added for dispatcher Auth.Permits + webhook panic recovery.
83 lines
2.8 KiB
Go
83 lines
2.8 KiB
Go
package telegram
|
|
|
|
import (
|
|
"context"
|
|
"crypto/subtle"
|
|
"encoding/json"
|
|
"errors"
|
|
"log"
|
|
"net/http"
|
|
"runtime/debug"
|
|
"time"
|
|
|
|
"github.com/go-telegram/bot"
|
|
"github.com/go-telegram/bot/models"
|
|
)
|
|
|
|
// secretTokenHeader is the case-insensitive HTTP header Telegram sets when it
|
|
// POSTs an update to the webhook. It must equal the value passed to setWebhook.
|
|
// See: https://core.telegram.org/bots/api#setwebhook
|
|
const secretTokenHeader = "X-Telegram-Bot-Api-Secret-Token"
|
|
|
|
// maxWebhookBody bounds inbound JSON. Telegram updates are well under 100 KiB
|
|
// even with media; 1 MiB is a defensive ceiling against malformed clients.
|
|
const maxWebhookBody = 1 << 20
|
|
|
|
// handlerTimeout caps a single Telegram update handler. Telegram retries after
|
|
// 60s of no 2xx; 10s leaves headroom for outbound API calls inside handlers
|
|
// without holding a Cloud Run instance long enough to block other updates.
|
|
const handlerTimeout = 10 * time.Second
|
|
|
|
// WebhookHandler returns an http.HandlerFunc that validates Telegram's secret
|
|
// token (constant-time) and dispatches the update synchronously to the bot.
|
|
//
|
|
// Dispatch is synchronous because the bot is constructed with
|
|
// bot.WithNotAsyncHandlers — handlers run inside this goroutine, so r.Context()
|
|
// stays live and bounded by handlerTimeout.
|
|
//
|
|
// secret must be non-empty; main is responsible for failing-fast at startup.
|
|
func WebhookHandler(b *bot.Bot, secret string) http.HandlerFunc {
|
|
secretBytes := []byte(secret)
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
if r.Method != http.MethodPost {
|
|
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
|
|
return
|
|
}
|
|
got := []byte(r.Header.Get(secretTokenHeader))
|
|
if subtle.ConstantTimeCompare(got, secretBytes) != 1 {
|
|
http.Error(w, "unauthorized", http.StatusUnauthorized)
|
|
return
|
|
}
|
|
|
|
r.Body = http.MaxBytesReader(w, r.Body, maxWebhookBody)
|
|
var update models.Update
|
|
if err := json.NewDecoder(r.Body).Decode(&update); err != nil {
|
|
// MaxBytesReader returns *http.MaxBytesError when the cap is hit;
|
|
// surface 413 distinctly so Telegram (and ops dashboards) can
|
|
// distinguish "body too big" from generic malformed JSON.
|
|
var maxBytesErr *http.MaxBytesError
|
|
if errors.As(err, &maxBytesErr) {
|
|
http.Error(w, "request body too large", http.StatusRequestEntityTooLarge)
|
|
return
|
|
}
|
|
http.Error(w, "bad request", http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
ctx, cancel := context.WithTimeout(r.Context(), handlerTimeout)
|
|
defer cancel()
|
|
// Recover panics so a buggy handler does not propagate up to the
|
|
// http.Server (which would close the response mid-write and trigger
|
|
// Telegram's 24-hour retry loop on the same poisoned update).
|
|
func() {
|
|
defer func() {
|
|
if rec := recover(); rec != nil {
|
|
log.Printf("webhook handler panic: %v\n%s", rec, debug.Stack())
|
|
}
|
|
}()
|
|
b.ProcessUpdate(ctx, &update)
|
|
}()
|
|
w.WriteHeader(http.StatusOK)
|
|
}
|
|
}
|