Running a Telegram Bot means it is connected to the public and you never know what's send to your Bot.
Bash scripts in general are not designed to be bullet proof, so consider this Bot as a proof of concept. Bash programmers often struggle with 'quoting hell' and globbing, see Implications of wrong quoting
Whenever you are processing input from untrusted sources (messages, files, network) you must be as careful as possible, e.g. set IFS appropriate, disable globbing (set -f) and quote everything. In addition remove unused scripts and examples from your Bot, e.g. everything in example/ and disable/remove all not needed bot commands.
It's important to escape or remove $ in input from user, files or network (as bashbot does) One of the powerful features of unix shells are variable and command substitution using ${} and$(), this can lead to remove code execution (RCE) or information disclosing bugs if unescaped $ is included in untrusted input, e.g. $$ or $(rm -rf /*)
It's important to escape or remove $ in input from user, files or network (as bashbot does) One of the powerful features of unix shells are variable and command substitution using ${} and$(), this can lead to remote code execution (RCE) or remote information disclosure (RID) bugs if unescaped $ is included in untrusted input, e.g. $$ or $(rm -rf /*)
A powerful tool to improve your scripts is shellcheck. You can use it online or install shellcheck locally. Shellcheck is used extensively in bashbot development to ensure a high code quality, e.g. it's not allowed to push changes without passing all shellcheck tests. In addition bashbot has a test suite to check if important functionality is working as expected.
If you're writing a script and it is taking external input (from the user as arguments or file system...), you shouldn't use echo to display it. Use printf whenever possible
@@ -390,6 +390,6 @@ It features background tasks and interactive chats, and can serve as an interfac@Gnadelwartz
If you feel that there's something missing or if you found a bug, feel free to submit a pull request!
-