BJS Security
BJS is very powerful and flexible. But with this. But simply make the code vulnerable.
Please read this article carefully
Especially if you work with payments, user balances, sell goods through a bot
Any user can execute any command
Vulnerable command /setBalance
:
Any user can run /setBalance [telegramid]
So need check execute this command only for admin:
1.Add this command to group
add admin to group "admin":
2. Or you can check admin in BJS
first you need get ADMIN_TELEGRAM_ID
security command:
Any user can execute any "SECRET" command
For example, you have command /payment
(have "Wait for answer") with execute other "secret" command /setBalance
:
"Secret" command /setBalance
So user must:
run /payment command
type secret one time password
after it - "secret" command "/setBalance" will be runned
Vulnerability: hacker can run /setBalance only and get bonus immediately
Need to checking that command /setBalance
was runned only by command /payment
one of the methods - pass secret on run command as params:
command /payment
Do not use "GJHURFVJLHF" secret!
It is not secret world already: hacker can read this doc too!
command /setBalance
User can run secret command on group chat
It can be accidentally or deliberately provoked by a hacker.
If you have a secret command with a secret result, do not run it in a group chat:
Recommendations
Do not share your bot token, BB API Key
Bot token and BB API Key - are is very vulnerability data. Do not share theys anywhere!
Avoid using safe data in protected bot
See full article here
Do not share your BB Bot ID
This can sometimes be unsafe.
Do not use default command names "/onIncome", "/onTransaction" for important commands
Hacker can brute force such command names and try to execute it
Remove /test command
If you have any /test command with non security BJS - remove it.
Hacker can execute /test too
Use completed_commands_count
variable
completed_commands_count
variableAnybody can run any command. But it is possible make secured sub command.
For example command /admin
command /secure
Do not use any non official libs now.
Do not use any non official libs now.
Any lib can run command with options.
Any libs can read properties (and read your API Keys from other lib)
We have not way to protect this now. Just not use NON official libs with CP lib. Well, that now there are no such libraries
Bad practice
User can change nickname
Bad BJS:
Any user can set any first_name, last_name and etc
Hacker can change or create account with this field
Use eval method with care
You can use eval for calculation
With such code you can make math calculator.
But it is very danger! User can run anything!
For example, user can pass BJS code: bot.token
. And bot will send your bot token!
See BB reports
Read info about BB report. Demo report have nice recommendations.
Last updated