BJS Security
BJS is very powerful and flexible. But with this. But simply make the code vulnerable.
Please read this article carefully
Especially if you work with payments, user balances, sell goods through a bot
Vulnerable command
/setBalance
:// admin can add 100$ to users's balance by it telegramid
tgID = params
let res = Libs.ResourcesLib.anotherUserRes("money", tgID);
res.add(100)
Bot.sendMessage("Added 100$ for user");
Any user can run /setBalance [telegramid]
So need check execute this command only for admin:

add admin to group "admin":
// create any temporary command with this code
// run it for admin
// destroy command after for security
// also you can protect this command with password
User.addToGroup("admin")
2. Or you can check admin in BJS
first you need get ADMIN_TELEGRAM_ID
Bot.sendMessage(user.telegramid)
security command:
if(user.telegramid!=ADMIN_TELEGRAM_ID){
return // exit from BJS
}
// ONLY admin can add 100$ to users's balance by it telegramid
tgID = params
let res = Libs.ResourcesLib.anotherUserRes("money", tgID);
res.add(100)
Bot.sendMessage("Added 100$ for user");
For example, you have command
/payment
(have "Wait for answer") with execute other "secret" command /setBalance
:// command /payment
// user provide oneTime password. If password is valid - add bonus 100$
var oneTimePassword = User.getProperty("oneTimePassword");
if(!oneTimePassword){
return // we have not oneTime password now
}
if(oneTimePassword=="already taked"){
// if taked already - exit
return
}
if(oneTimePassword!=message){
// user do not know oneTime password
Bot.sendMessager("Error. Password is wrong")
}
if(oneTimePassword==message){
// user know oneTime password!
// make it "already taked"
User.setProperty("oneTimePassword", "already taked", "string")
// run "secret" command
Bot.runCommand("/setBalance");
Bot.sendMessage("Thank you for payment!");
}
"Secret" command
/setBalance
let res = Libs.ResourcesLib.userRes("money", tgID);
res.add(100)
Bot.sendMessage("Added 100$ for you");
So user must:
- run /payment command
- type secret one time password
- after it - "secret" command "/setBalance" will be runned
Vulnerability: hacker can run /setBalance only and get bonus immediately
Need to checking that command
/setBalance
was runned only by command /payment
one of the methods - pass secret on run command as params:
command
/payment
...
// part of code for /payment
if(oneTimePassword==message){
...
var secret = "GJHURFVJLHF" // use own secret. You can store it in property
Bot.runCommand("/setBalance");
Bot.sendMessage("Thank you for payment!");
}
Do not use "GJHURFVJLHF" secret!
It is not secret world already: hacker can read this doc too!
command
/setBalance
if(params=="GJHURFVJLHF"){
let res = Libs.ResourcesLib.userRes("money", tgID);
res.add(100)
Bot.sendMessage("Added 100$ for you");
}else{
Bot.sendMessage("You are hacker!")
}
It can be accidentally or deliberately provoked by a hacker.
If you have a secret command with a secret result, do not run it in a group chat:
// send this link only in PM - secure reason
if(chat.chat_type!="private"){
return
}
Bot token and BB API Key - are is very vulnerability data. Do not share theys anywhere!
This can sometimes be unsafe.
Hacker can brute force such command names and try to execute it
If you have any /test command with non security BJS - remove it.
Hacker can execute /test too
Anybody can run any command. But it is possible make secured sub command.
For example command
/admin
// make admin access here
// ...
Bot.runCommand("/secure")
command
/secure
// this command can not be runned by user
if(completed_commands_count==0){ return }
// only via Bot.runCommand, Bot.run or as "on_result"
// your secure code here
// ...
Do not use any non official libs now.
- Any lib can run command with options.
- Any libs can read properties (and read your API Keys from other lib)
We have not way to protect this now. Just not use NON official libs with CP lib. Well, that now there are no such libraries
Bad BJS:
let admin = "Jon Smith";
if (user.first_name==admin){
// do admin action here
...
}
Any user can set any first_name, last_name and etc
Hacker can change or create account with this field
You can use eval for calculation
// with Wait for Answer
// message from user is: 2+2
// eval - it js execution from string
let result = eval(message);
// 2+2 = 4. So we have 4 in result now
Bot.sendMessage(result)
With such code you can make math calculator.
But it is very danger! User can run anything!
For example, user can pass BJS code:
bot.token
. And bot will send your bot token!Last modified 1yr ago