Skip to content

Commit

Permalink
Updated actual tg flow
Browse files Browse the repository at this point in the history
  • Loading branch information
ihsraham committed Oct 21, 2024
1 parent 2dd0ab9 commit 0b3db71
Showing 1 changed file with 22 additions and 19 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -75,32 +75,35 @@ app.post("/auth/telegram", async (req, res) => {
return res.status(400).json({ error: "initDataRaw is required" });
}

if (isMocked) {
// Directly parse the mocked initDataRaw without validation
try {
const data = new URLSearchParams(initDataRaw);
const user = JSON.parse(decodeURIComponent(data.get("user"))); // Decode the 'user' parameter from initDataRaw
console.log("Decoded Init Data:", data.toString());

Check warning

Code scanning / CodeQL

Log injection Medium

Log entry depends on a
user-provided value
.

const mockUser = {
id: user.id,
username: user.username,
photo_url: user.photo_url || "https://www.gravatar.com/avatar", // Default photo URL for mocked user
first_name: user.first_name,
};
if (isMocked) {

Check failure

Code scanning / CodeQL

User-controlled bypass of security check High

This condition guards a sensitive
action
, but a
user-provided value
controls it.
const user = JSON.parse(decodeURIComponent(data.get("user"))); // Decode the 'user' parameter from initDataRaw

console.log("Parsed mock user data:", mockUser);
const mockUser = {
id: user.id,
username: user.username,
photo_url: user.photo_url || "https://www.gravatar.com/avatar", // Default photo URL for mocked user
first_name: user.first_name,
};

const JWTtoken = generateJwtToken(mockUser);
return res.json({ token: JWTtoken });
}
console.log("Parsed mock user data:", mockUser);
const JWTtoken = generateJwtToken(mockUser);
return res.json({ token: JWTtoken });
}

// For real scenarios, proceed with validation
const validator = new AuthDataValidator({ botToken: TELEGRAM_BOT_TOKEN });
const data = objectToAuthDataMap(new URLSearchParams(initDataRaw));
// For real scenarios, proceed with validation
const validator = new AuthDataValidator({ botToken: TELEGRAM_BOT_TOKEN });
const telegramData = objectToAuthDataMap(data);

try {
const user = await validator.validate(data);
console.log("Telegram data before validation:", telegramData);

const user = await validator.validate(telegramData);

console.log("Validated user:", user);

// Ensure a photo URL is available or use a default one
const validatedUser = {
...user,
photo_url: user.photo_url || "https://www.gravatar.com/avatar", // Fallback photo URL if missing
Expand Down

0 comments on commit 0b3db71

Please sign in to comment.