From 67b9039d51c17f8d9b752af75187f56580127856 Mon Sep 17 00:00:00 2001 From: "Kay Marquardt (Gnadelwartz)" Date: Wed, 27 May 2020 09:06:22 +0200 Subject: [PATCH] fix not working jssh_updateDB --- README.html | 4 +++- README.md | 2 +- README.txt | 12 +++++++++++- modules/jsonDB.sh | 20 ++++++++++---------- 4 files changed, 25 insertions(+), 13 deletions(-) diff --git a/README.html b/README.html index ac3842f..15590ae 100644 --- a/README.html +++ b/README.html @@ -178,6 +178,7 @@ It features background tasks and interactive chats, and can serve as an interfac

Running a Telegram Bot means it is connected to the public and you never know whats send to your Bot.

Bash scripts in general are not designed to be bullet proof, so consider this Bot as a proof of concept. Bash programmers often struggle with 'quoting hell' and globbing, see Implications of wrong quoting

Whenever you are processing input from from untrusted sources (messages, files, network) you must be as carefull as possible, e.g. set IFS appropriate, disable globbing (set -f) and quote everthing. In addition delete unused scripts and examples from your Bot, e.g. scripts 'notify', 'calc', 'question', and disable all not used commands.

+

Note: Until v0.941 (mai/22/2020) telegram-bot-bash has a remote code execution bug, pls update if you use an older version! One of the most powerful features of unix shells like bash is variable and command substitution, this can lead to RCE and information disclosing bugs if you do not escape '$' porperly, see Issue #125

A powerful tool to improve your scripts is shellcheck. You can use it online or install shellcheck locally. Shellcheck is used extensive in bashbot development to enshure a high code quality, e.g. it's not allowed to push changes without passing all shellcheck tests. In addition bashbot has a test suite to check if important functionality is working as expected.

Do not use #!/usr/bin/env bash

We stay with /bin/bash shebang, because it's more save from security perspective.

@@ -193,6 +194,7 @@ It features background tasks and interactive chats, and can serve as an interfac

FAQ

Is this Bot insecure?

Bashbot is not more (in)secure as any other Bot written in any other language, we have done our best to make it as secure as possible. But YOU are responsible for the bot commands you wrote and you should know about the risks ...

+

Note: Until v0.941 (mai/22/2020) telegram-bot-bash has a remote code execution bug, pls update if you use an older version!

Why Bash and not the much better xyz?

Well, thats a damn good question ... may be because I'm an Unix/Linux admin from stone age. Nevertheless there are more reasons from my side: