search

EatMoreCode / Telegram-Bot

Perl module to make creating new Telegram bots easy
4 stars 6 forks source link

Bot blows up on new_chat_member update #8

Open simbabque opened 1 year ago

simbabque commented 1 year ago

When a bot gets added to a group that already exists it receives a new_chat_member update of the type https://core.telegram.org/bots/api#chatmemberupdated. This is not supported in Telegram::Bot::Brain::_process_message so we blow up.

It's also not possible to opt out of it by supplying a custom list of updates we would like to receive, which would be a valid workaround using allowed_updates from https://core.telegram.org/bots/api#getupdates.

Are you open to receiving PRs for either of these, or both?

jkg commented 1 year ago

This same issue occurs when a user hits "Delete & Stop" in their direct message with the bot, the update to let the bot know it has been "kicked" from the one-to-one chat tickles the exact same issue.

Since the bot can no longer process any messages at all until that update is queued from the API, this means the bot has a trivial denial of service vulnerability - any user can open and then delete a DM with it, and the bot will die until the API update queue can be cleared.