Whenever you are processing input from from untrusted sources (messages, files, network) you must be as carefull as possible, e.g. set IFS appropriate, disable globbing (set -f) and quote everthing. In addition delete unused scripts and examples from your Bot, e.g. scripts 'notify', 'calc', 'question', and disable all not used commands.
Note: Until v0.941 (mai/22/2020) telegram-bot-bash has a remote code execution bug, pls update if you use an older version! One of the most powerful features of unix shells like bash is variable and command substitution, this can lead to RCE and information disclosing bugs if you do not escape '$' porperly, see Issue #125
A powerful tool to improve your scripts is shellcheck. You can use it online or install shellcheck locally. Shellcheck is used extensive in bashbot development to enshure a high code quality, e.g. it's not allowed to push changes without passing all shellcheck tests. In addition bashbot has a test suite to check if important functionality is working as expected.
If you're writing a script and it is taking external input (from the user as arguments, or file names from the file system...), you shouldn't use echo to display it. Use printf whenever possible
+ # very simple
+ echo "text with variables. PWD=$PWD"
+ printf '%s\n' "text with variables. PWD=$PWD"
+ -> text with variables. PWD=/home/xxx
+
+ # more advanced
+ FLOAT="1.2346777892864" INTEGER="12345.123"
+ echo "text with variabeles. float=$FLOAT, integer=$INTEGER, PWD=$PWD"
+ ->text with variables. float=1.2346777892864, integer=12345.123, PWD=/home/xxx
+
+ printf "text with variables. float=%.2f, integer=%d, PWD=%s\n" "" "$INTEGER" "$PWD"
+ ->text with variables. float=1.23, integer=12345, PWD=/home/xxxWe stay with /bin/bash shebang, because it's more save from security perspective.
Using a fixed path to the system provided bash makes it harder for attackers or users to place alternative versions of bash and avoids using a possibly broken, mangled or compromised bash executable.
@@ -210,27 +224,27 @@ It features background tasks and interactive chats, and can serve as an interfacOf course, you can send messages from CLI and scripts, simply install bashbot as described here, send the messsage '/start' to set yourself as botadmin and stop the bot with ./bashbot.sh kill.
Run the following commands in your bash shell or script while you are in the installation directory:
-# prepare bash / script to send commands
-export BASHBOT_HOME="$(pwd)"
-source ./bashbot.sh source
-
-# send me a test message
-send_message "$(cat "$BOTADMIN")" "test"
-
-# send me output of a system command
-send_message "$(<"$BOTADMIN")" "$(df -h)"# prepare bash / script to send commands
+export BASHBOT_HOME="$(pwd)"
+source ./bashbot.sh source
+
+# send me a test message
+send_message "$(cat "$BOTADMIN")" "test"
+
+# send me output of a system command
+send_message "$(<"$BOTADMIN")" "$(df -h)"For more information see Expert Use
May be your IP is blocked by telegram. You can test this by running curl or wget manually:
-curl -m 10 https://api.telegram.org/bot
-#curl: (28) Connection timed out after 10001 milliseconds
-
-wget -t 1 -T 10 https://api.telegram.org/bot
-#Connecting to api.telegram.org (api.telegram.org)|46.38.243.234|:443... failed: Connection timed out.curl -m 10 https://api.telegram.org/bot
+#curl: (28) Connection timed out after 10001 milliseconds
+
+wget -t 1 -T 10 https://api.telegram.org/bot
+#Connecting to api.telegram.org (api.telegram.org)|46.38.243.234|:443... failed: Connection timed out.This may happen if to many wrong requests are sent to api.telegram.org, e.g. using a wrong token or not existing API calls. If you have a fixed IP you can ask telegram service to unblock your ip or change your IP. If you are running a socks or tor proxy on your server look for the BASHBOT_CURL_ARGS lines in 'mycommands.sh' as example.
@Gnadelwartz
If you feel that there's something missing or if you found a bug, feel free to submit a pull request!
-