octoleo/telegram-bot-bash
1
1
Fork 0
mirror of https://github.com/octoleo/telegram-bot-bash.git synced 2024-11-10 19:40:55 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #127 from topkecleon/develop

Browse Source 
fix not working jssh_updateDB hack
This commit is contained in:
Kay Marquardt 2020-05-27 09:08:55 +02:00 committed by GitHub
commit 2e9587a11d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 25 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
README.html
View File

@ -178,6 +178,7 @@ It features background tasks and interactive chats, and can serve as an interfac
<p>Running a Telegram Bot means it is connected to the public and you never know whats send to your Bot.</p>
<p>Bash scripts in general are not designed to be bullet proof, so consider this Bot as a proof of concept. Bash programmers often struggle with 'quoting hell' and globbing, see <a href="https://unix.stackexchange.com/questions/171346/security-implications-of-forgetting-to-quote-a-variable-in-bash-posix-shells">Implications of wrong quoting</a></p>
<p>Whenever you are processing input from from untrusted sources (messages, files, network) you must be as carefull as possible, e.g. set IFS appropriate, disable globbing (set -f) and quote everthing. In addition delete unused scripts and examples from your Bot, e.g. scripts 'notify', 'calc', 'question', and disable all not used commands.</p>
<p><strong>Note:</strong> Until v0.941 (mai/22/2020) telegram-bot-bash has a remote code execution bug, pls update if you use an older version! One of the most powerful features of unix shells like bash is variable and command substitution, this can lead to RCE and information disclosing bugs if you do not escape '$' porperly, see <a href="https://github.com/topkecleon/telegram-bot-bash/issues/125">Issue #125</a></p>
<p>A powerful tool to improve your scripts is <code>shellcheck</code>. You can <a href="https://www.shellcheck.net/">use it online</a> or <a href="https://github.com/koalaman/shellcheck#installing">install shellcheck locally</a>. Shellcheck is used extensive in bashbot development to enshure a high code quality, e.g. it's not allowed to push changes without passing all shellcheck tests. In addition bashbot has a <a href="doc/7_develop.md">test suite</a> to check if important functionality is working as expected.</p>
<h3>Do not use #!/usr/bin/env bash</h3>
<p><strong>We stay with /bin/bash shebang, because it's more save from security perspective.</strong></p>
@ -193,6 +194,7 @@ It features background tasks and interactive chats, and can serve as an interfac
<h2>FAQ</h2>
<h3>Is this Bot insecure?</h3>
<p>Bashbot is not more (in)secure as any other Bot written in any other language, we have done our best to make it as secure as possible. But YOU are responsible for the bot commands you wrote and you should know about the risks ...</p>
<p><strong>Note:</strong> Until v0.941 (mai/22/2020) telegram-bot-bash has a remote code execution bug, pls update if you use an older version!</p>
<h3>Why Bash and not the much better xyz?</h3>
<p>Well, thats a damn good question ... may be because I'm an Unix/Linux admin from stone age. Nevertheless there are more reasons from my side:</p>
<ul>
@ -228,6 +230,6 @@ It features background tasks and interactive chats, and can serve as an interfac
<p>@Gnadelwartz</p>
<h2>That's it!</h2>
<p>If you feel that there's something missing or if you found a bug, feel free to submit a pull request!</p>
<h4>$$VERSION$$ v0.96-dev-8-ge63590b</h4>
<h4>$$VERSION$$ 0.96-dev2-0-gcbad540</h4>
</body>
</html>

2
README.md
View File

@ -197,4 +197,4 @@ This may happen if to many wrong requests are sent to api.telegram.org, e.g. usi
If you feel that there's something missing or if you found a bug, feel free to submit a pull request!
#### $$VERSION$$ v0.96-dev-8-ge63590b
#### $$VERSION$$ 0.96-dev2-0-gcbad540

12
README.txt
View File

@ -147,6 +147,13 @@ globbing (set -f) and quote everthing. In addition delete unused scripts and
examples from your Bot, e.g. scripts 'notify', 'calc', 'question', and disable
all not used commands.
**Note:** Until v0.941 (mai/22/2020) telegram-bot-bash has a remote code
execution bug, pls update if you use an older version!
One of the most powerful features of unix shells like bash is variable and
command substitution, this can lead to RCE and information disclosing bugs if
you do not escape '$' porperly, see [Issue
#125](https://github.com/topkecleon/telegram-bot-bash/issues/125)
A powerful tool to improve your scripts is ```shellcheck```. You can [use it
online](https://www.shellcheck.net/) or [install shellcheck
locally](https://github.com/koalaman/shellcheck#installing). Shellcheck is used
@ -200,6 +207,9 @@ Bashbot is not more (in)secure as any other Bot written in any other language,
we have done our best to make it as secure as possible. But YOU are responsible
for the bot commands you wrote and you should know about the risks ...
**Note:** Until v0.941 (mai/22/2020) telegram-bot-bash has a remote code
execution bug, pls update if you use an older version!
### Why Bash and not the much better xyz?
Well, thats a damn good question ... may be because I'm an Unix/Linux admin
from stone age. Nevertheless there are more reasons from my side:
@ -270,4 +280,4 @@ in 'mycommands.sh' as example.
If you feel that there's something missing or if you found a bug, feel free to
submit a pull request!
#### $$VERSION$$ v0.96-dev-8-ge63590b
#### $$VERSION$$ 0.96-dev2-0-gcbad540

20
modules/jsonDB.sh
View File

@ -5,7 +5,7 @@
# This file is public domain in the USA and all free countries.
# Elsewhere, consider it to be WTFPLv2. (wtfpl.net/txt/copying)
#
#### $$VERSION$$ v0.96-dev-7-g0153928
#### $$VERSION$$ 0.96-dev2-0-gcbad540
#
# source from commands.sh to use jsonDB functions
#
@ -63,7 +63,7 @@ if _exists flock; then
declare -n ARRAY="$1"
[ -z "${ARRAY[*]}" ] && return 1
declare -A oldARR newARR
declare -A oldARR
# start atomic update here, exclusive max wait 10s
{ flock -e -w 10 200
@ -73,14 +73,14 @@ if _exists flock; then
Array2Json "$1" >"${DB}"
else
# merge arrays
local o1 o2 n1 n2
o1="$(declare -p oldARR)"; o2="${o1#*\(}"
n1="$(declare -p ARRAY)"; n2="${n1#*\(}"
unset IFS; set -f
#shellcheck disable=SC2034,SC2190,SC2206
newARR=( ${o2:0:${#o2}-1} ${n2:0:${#n2}-1} )
set +f
Array2Json "newARR" >"${DB}"
local key
set -x
for key in "${!ARRAY[@]}"
do
oldARR["${key}"]="${ARRAY["${key}"]}"
done
Array2Json "oldARR" >"${DB}"
set +x
fi
} 200>"${DB}${BASHBOT_LOCKNAME}"
}