基于Dineshkarthik的项目, 电报视频下载,电报资源下载,跨平台,支持web查看下载进度 ,支持bot下发指令下载,支持下载已经加入的私有群但是限制下载的资源, telegram media download,Download media files from a telegram conversation/chat/channel up to 2GiB per file
We are a cybersecurity research group from the CISPA Helmholtz Center for Information Security and Ca’ Foscari University of Venice. We recently conducted an analysis of the session management used in your web application as part of our research. We have discovered a security vulnerability that we believe requires your attention.
Vulnerability Description:
After our analysis, we have identified that your application is using a hard-coded secret key that is leaked through GitHub. If operators who install your web application do not change this secret key, they are vulnerable to cookie forgeries. The cookie forgery attack allows an attacker, knowing the key used to sign a cookie, to forge new arbitrary cookies to impersonate and take over other accounts.
To address this vulnerability and enhance the security posture of your web application, we highly recommend setting the secret key from an environment variable. If the environment file is not shared on GitHub then this would force operators of your application to create their own key upon installation, forcing them to set their own secure secret key.
We hope this notification helps improve your security. Can you take a look into the relevant code parts and comment on the issue?
telegram_media_downloader version or commit
latest
What OS are you seeing the problem on?
Windows
Python Version
No response
What happened?
Hello,
We are a cybersecurity research group from the CISPA Helmholtz Center for Information Security and Ca’ Foscari University of Venice. We recently conducted an analysis of the session management used in your web application as part of our research. We have discovered a security vulnerability that we believe requires your attention.
Vulnerability Description:
After our analysis, we have identified that your application is using a hard-coded secret key that is leaked through GitHub. If operators who install your web application do not change this secret key, they are vulnerable to cookie forgeries. The cookie forgery attack allows an attacker, knowing the key used to sign a cookie, to forge new arbitrary cookies to impersonate and take over other accounts.
link to the relevant code part
Recommendation for Mitigation:
To address this vulnerability and enhance the security posture of your web application, we highly recommend setting the secret key from an environment variable. If the environment file is not shared on GitHub then this would force operators of your application to create their own key upon installation, forcing them to set their own secure secret key.
We hope this notification helps improve your security. Can you take a look into the relevant code parts and comment on the issue?
Expected Behavior
.
Current Behavior
.
Possible Solution
No response
Steps to Reproduce
No response
Relevant log output
No response