windkh / node-red-contrib-telegrambot

Telegram bot nodes for node-red.
Other
256 stars 117 forks source link

GetFile does not get complete url #381

Closed gmag11 closed 1 week ago

gmag11 commented 1 week ago

After https://github.com/windkh/node-red-contrib-telegrambot/commit/13ae259da9b0e423c8c63753a5457758a134b729 getFile function does not work as expected.

There is a type here: https://github.com/windkh/node-red-contrib-telegrambot/blob/a94350505117326967ab95d0887ddb382db7d88b/telegrambot/99-telegrambot.js#L2163

Code looks for msg.payload.getfile but the tries to use msg.payload.getFile.

Besides, the code that gets full file url has been dropped.

I have two proposals for a PR:

  1. Add the url as file_url to current payload.content like this:
"payload": {
    "content": {
        "file_id":"xxxxxxxxxxxx",
        "file_size":35362,
        "file_path":"photos/file_234.jpg",
        "file_link":"https://api.telegram.org/file/bot12345667:xxxxxxxxxxxxxxxxxxxx/photos/file_234.jpg"
    }
}
  1. Add a new function getFileLink. So that payload.content has only the link:
"payload": {
    "content":"https://api.telegram.org/file/bot12345667:xxxxxxxxxxxxxxxxxxxx/photos/file_234.jpg"
}

First option may leak bot token if output is fed to a public service.

Link may be built externally by using file_path but it needs bot token, that is only available in configuration node.

Let me know if there is another alternative.

windkh commented 1 week ago

Thanks for reporting, I was surprised when I saw the diff as I can't remember having done that... will fix it asap

gmag11 commented 1 week ago

Think about the possible bot token leak. Maybe this can be activated with a checkbox in node config.

What is getFile supposed to do? I mean, getFile implementation in node-contrib-telegram-bot just returns file path what is useless if you don't have the token to build the absolute url.

getFileLink function does exactly that. Telegram API is confusing sometimes 😄

windkh commented 1 week ago

@gmag11 getFileLink is only syntactical sugar: it calls getFile and creates a full url from the relative path. I will replace getFile with getFileLink.

About leaking the bot token: before sending this output to some public server you need to remove that link.