fix(telegram): redact bot token from connect/disconnect/send_document/send_video errors - #58893
Merged
teknium1 merged 1 commit intoJul 5, 2026
Conversation
…/send_video errors _redact_telegram_error_text() strips bot tokens from api.telegram.org URLs embedded in transport-error text, and is already applied across the send/edit transient-error paths. Four sites still built their message from the raw exception: - connect()'s fatal-error handler is the most severe: the raw text is passed to _set_fatal_error(), which persists it via write_runtime_status() to a dashboard/admin-facing runtime status file, not just a log line. A transient network error during startup commonly embeds the request URL (https://api.telegram.org/bot<TOKEN>/getMe), so this could leak the live bot token into that surface. - disconnect(), send_document(), send_video() build the same unredacted pattern into a warning log line (lower blast radius, but the same leak class). Fix: route all four through the existing _redact_telegram_error_text() helper before building the message/log line, mirroring the send/edit paths exactly. Also drops exc_info=True from the two logger.error/ logger.warning calls that had it — exc_info prints the exception's own traceback (including its unredacted message) separately from the format string, which would otherwise defeat the redaction; the already-redacted sibling call sites in this file follow the same convention.
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
_redact_telegram_error_text()(plugins/platforms/telegram/adapter.py) strips bot tokens fromapi.telegram.org/bot<TOKEN>/...URLs embedded in transport-error text, and is already applied across the send/edit transient-error paths. Four sites still built their message from the raw, unredacted exception:connect()'s fatal-error handler — the most severe:message = f"Telegram startup failed: {e}"is passed toself._set_fatal_error(...), which calls_write_runtime_status_safe(...)→write_runtime_status(...), persisting the raw text to a dashboard/admin-facing runtime status file, not just a log line. A transient network error during startup commonly embeds the request URL (https://api.telegram.org/bot<TOKEN>/getMe), so this could leak the live bot token into that surface.disconnect(),send_document(),send_video()— build the same unredacted pattern into alogger.warning(...)line. Lower blast radius (log-only), but the same leak class.Related Issue
No filed issue. Note: open PR #58594 covers 3 different sites in this file (
sendRichMessagefallback,editMessageTextfallback, polling-reconnect warning) — no overlap with the 4 sites this PR touches (verified by diffing #58594 against currentplugins/platforms/telegram/adapter.py).Type of Change
c3ab1424ealready fixed for the send/edit paths)Changes Made
plugins/platforms/telegram/adapter.py: routeconnect(),disconnect(),send_document(),send_video()through the existing_redact_telegram_error_text()helper before building the message/log line (+11/-5 lines). Also dropsexc_info=Truefrom the two call sites that had it —exc_infoprints the exception's own traceback (including its unredacted message) separately from the format string, which would otherwise defeat the redaction; the already-redacted sibling call sites in this file follow the same convention.tests/gateway/test_telegram_error_redaction.py: new regression tests for all 4 sites, each injecting a synthetic bot-token URL and asserting it never reaches the persisted fatal-error message (connect) or the log output (disconnect/send_document/send_video)How to Test
Mutation-verified: all 4 new tests fail against the pre-fix code (the raw token URL appears in the fatal-error message / log output).
Checklist