fix(telegram): redact bot tokens from all remaining transport-error sites (#58594 salvage) - #65508
Merged
Merged
Conversation
Telegram Bot API URLs carry credentials in the path as /bot<TOKEN>/<method>. Three error-handling paths logged raw exception text that could include these URLs: - sendRichMessage fallback (line 1603) - editMessageText fallback (line 1709) - polling reconnect warning (line 1902) Replace raw / with which uses the existing redact_sensitive_text(force=True) pipeline. This matches the pattern already used by transient send failures, retry errors, and legacy edit paths. Fixes #58376
…xception sites Extends @AlexFucuson9's 3-site fix (#58594) across the full adapter: every logger call and SendResult.error that interpolates a raw PTB exception now routes through _redact_telegram_error_text(). Covers polling conflict/retry/network ladders, overflow-split edits, draft sends, prompt/approval/clarify/picker sends, media send fallbacks, media cache failures, reactions, and chat-info lookups (48 additional sites). Telegram Bot API exceptions embed the token in the request URL (/bot<TOKEN>/<method>), so any raw str(exc) is a leak surface. Adds regression tests for SendResult.error redaction (update prompt, clarify) and delete_message debug-log redaction.
alt-glitch
added
type/security
Collaborator
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Telegram transport errors can no longer leak the bot token through any adapter log line or
SendResult.error. Telegram Bot API exceptions embed the credential in the request URL (/bot<TOKEN>/<method>), so every rawstr(exception)interpolation is a leak surface. Closes #58376.Salvages PR #58594 by @AlexFucuson9 (3 remaining sites from the original issue: rich-send rejected, rich-edit rejected, polling-degraded) and widens the fix to the whole class: all 48 additional raw-exception sites in the adapter now route through the existing
_redact_telegram_error_text()helper (forced redaction, independent of the globalsecurity.redact_secretstoggle).Changes
plugins/platforms/telegram/adapter.py: 51 raw-exception sites redacted — polling conflict/retry/network ladders, bootstrap conflict, deleteWebhook, overflow-split edits, draft sends, update-prompt/exec-approval/slash-confirm/clarify/model-picker sends (log +SendResult.error), media send fallbacks (voice, media group, photo→document, URL photo, animation), media cache failures (photo/voice/audio/video/document/sticker — PTB file-download URLs embed/file/bot<TOKEN>/), typing indicator, chat info, reactions, DM-topic and command-menu registration.tests/gateway/test_telegram_error_redaction.py: +3 regression tests covering theSendResult.errorreturn surface (update prompt, clarify) anddelete_messagedebug logging.Validation
tests/gateway/test_telegram_error_redaction.pyscripts/run_tests.sh tests/gateway/ -k telegramSendResult.error;***marker presentContributor commit cherry-picked with authorship preserved; merge via rebase.
Infographic