Skip to content

fix(telegram): redact bot token from connect/disconnect/send_document/send_video errors - #58893

Merged
teknium1 merged 1 commit into
NousResearch:mainfrom
srojk34:fix/telegram-connect-token-redact
Jul 5, 2026
Merged

fix(telegram): redact bot token from connect/disconnect/send_document/send_video errors#58893
teknium1 merged 1 commit into
NousResearch:mainfrom
srojk34:fix/telegram-connect-token-redact

Conversation

@srojk34

@srojk34 srojk34 commented Jul 5, 2026

Copy link
Copy Markdown
Contributor

What does this PR do?

_redact_telegram_error_text() (plugins/platforms/telegram/adapter.py) strips bot tokens from api.telegram.org/bot<TOKEN>/... URLs embedded in transport-error text, and is already applied across the send/edit transient-error paths. Four sites still built their message from the raw, unredacted exception:

  • connect()'s fatal-error handler — the most severe: message = f"Telegram startup failed: {e}" is passed to self._set_fatal_error(...), which calls _write_runtime_status_safe(...)write_runtime_status(...), persisting the raw text to a dashboard/admin-facing runtime status file, not just a log line. A transient network error during startup commonly embeds the request URL (https://api.telegram.org/bot<TOKEN>/getMe), so this could leak the live bot token into that surface.
  • disconnect(), send_document(), send_video() — build the same unredacted pattern into a logger.warning(...) line. Lower blast radius (log-only), but the same leak class.

Related Issue

No filed issue. Note: open PR #58594 covers 3 different sites in this file (sendRichMessage fallback, editMessageText fallback, polling-reconnect warning) — no overlap with the 4 sites this PR touches (verified by diffing #58594 against current plugins/platforms/telegram/adapter.py).

Type of Change

  • 🔒 Security fix (credential leak — same class c3ab1424e already fixed for the send/edit paths)

Changes Made

  • plugins/platforms/telegram/adapter.py: route connect(), disconnect(), send_document(), send_video() through the existing _redact_telegram_error_text() helper before building the message/log line (+11/-5 lines). Also drops exc_info=True from the two call sites that had it — exc_info prints the exception's own traceback (including its unredacted message) separately from the format string, which would otherwise defeat the redaction; the already-redacted sibling call sites in this file follow the same convention.
  • tests/gateway/test_telegram_error_redaction.py: new regression tests for all 4 sites, each injecting a synthetic bot-token URL and asserting it never reaches the persisted fatal-error message (connect) or the log output (disconnect/send_document/send_video)

How to Test

pytest tests/gateway/test_telegram_error_redaction.py tests/gateway/test_telegram_rich_messages.py -v

Mutation-verified: all 4 new tests fail against the pre-fix code (the raw token URL appears in the fatal-error message / log output).

Checklist

  • Contributing Guide read | Conventional Commits | No duplicate PR found for these 4 sites (checked fix(telegram): redact bot tokens from transport error logs #58594's diff directly — different, non-overlapping sites)
  • Scoped to these 4 sites | Tests added | Platform: macOS
  • Docs — N/A | Cross-platform — N/A (pure Python string handling)

…/send_video errors

_redact_telegram_error_text() strips bot tokens from api.telegram.org
URLs embedded in transport-error text, and is already applied across the
send/edit transient-error paths. Four sites still built their message
from the raw exception:

- connect()'s fatal-error handler is the most severe: the raw text is
  passed to _set_fatal_error(), which persists it via
  write_runtime_status() to a dashboard/admin-facing runtime status
  file, not just a log line. A transient network error during startup
  commonly embeds the request URL
  (https://api.telegram.org/bot<TOKEN>/getMe), so this could leak the
  live bot token into that surface.
- disconnect(), send_document(), send_video() build the same unredacted
  pattern into a warning log line (lower blast radius, but the same
  leak class).

Fix: route all four through the existing _redact_telegram_error_text()
helper before building the message/log line, mirroring the send/edit
paths exactly. Also drops exc_info=True from the two logger.error/
logger.warning calls that had it — exc_info prints the exception's own
traceback (including its unredacted message) separately from the format
string, which would otherwise defeat the redaction; the already-redacted
sibling call sites in this file follow the same convention.
@alt-glitch alt-glitch added type/security Security vulnerability or hardening comp/gateway Gateway runner, session dispatch, delivery platform/telegram Telegram bot adapter area/auth Authentication, OAuth, credential pools P3 Low — cosmetic, nice to have labels Jul 5, 2026
@teknium1
teknium1 merged commit 1e2914b into NousResearch:main Jul 5, 2026
31 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/auth Authentication, OAuth, credential pools comp/gateway Gateway runner, session dispatch, delivery P3 Low — cosmetic, nice to have platform/telegram Telegram bot adapter type/security Security vulnerability or hardening

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants