diff --git a/.gitignore b/.gitignore index 1fb2e6c..cc105cb 100644 --- a/.gitignore +++ b/.gitignore @@ -6,5 +6,4 @@ *.log /JSON.sh/ /data-bot-bash/ -/tmp-bot-bash/ /dist/ diff --git a/README.html b/README.html index 52ab189..7e82acd 100644 --- a/README.html +++ b/README.html @@ -74,9 +74,9 @@
Running a Telegram Bot means it is connected to the public and you never know whats send to your Bot.
-Bash scripts in general are not designed to be bullet proof, so consider this Bot as a proof of concept. More concret examples of security problems are: bash’s ‘quoting hell’ and globbing. Implications of wrong quoting
-Whenever you are processing input from from untrusted sources (messages, files, network) you must be as carefull as possible, e.g. set IFS appropriate, disable globbing (set -f) and quote everthing. In addition disable not used Bot commands and delete unused scripts from your Bot, e.g. example scripts ‘notify’, ‘calc’, ‘question’,
-A powerful tool to improve your scripts robustness is shellcheck
. You can use it online or install shellcheck locally. All bashbot scripts are checked by shellcheck.
Bash scripts in general are not designed to be bullet proof, so consider this Bot as a proof of concept. Bash programmers often struggle with ‘quoting hell’ and globbing, see Implications of wrong quoting
+Whenever you are processing input from from untrusted sources (messages, files, network) you must be as carefull as possible, e.g. set IFS appropriate, disable globbing (set -f) and quote everthing. In addition delete unused scripts and examples from your Bot, e.g. scripts ‘notify’, ‘calc’, ‘question’, and disable all not used commands.
+A powerful tool to improve your scripts is shellcheck
. You can use it online or install shellcheck locally. Shellcheck is used extensive in bashbot development to enshure a high code quality, e.g. it’s not allowed to push changes without passing all shellcheck tests. In addition bashbot has a test suite to check if important functionality is working as expected.
I recommend to run your bot as a user, with almost no access rights. All files your Bot have write access to are in danger to be overwritten/deleted if your bot is hacked. For the same reason ervery file your Bot can read is in danger to be disclosed. Restict your Bots access rigths to the absolute minimum.
Never run your Bot as root, this is the most dangerous you can do! Usually the user ‘nobody’ has almost no rights on Unix/Linux systems. See Expert use on how to run your Bot as an other user.
@@ -97,6 +97,6 @@@Gnadelwartz
If you feel that there’s something missing or if you found a bug, feel free to submit a pull request!
-