BJS Security

BJS is very powerful and flexible. But with this. But simply make the code vulnerable.

Please read this article carefully

Especially if you work with payments, user balances, sell goods through a bot

Any user can execute any command

Vulnerable command /setBalance:

// admin can add 100$ to users's balance by it telegramid
tgID = params
let res = Libs.ResourcesLib.anotherUserRes("money", tgID);
res.add(100)
Bot.sendMessage("Added 100$ for user");

Any user can run /setBalance [telegramid]

So need check execute this command only for admin:

1.Add this command to group

add admin to group "admin":

// create any temporary command with this code
// run it for admin
// destroy command after for security
// also you can protect this command with password
User.addToGroup("admin")

2. Or you can check admin in BJS

first you need get ADMIN_TELEGRAM_ID

Bot.sendMessage(user.telegramid)

security command:

if(user.telegramid!=ADMIN_TELEGRAM_ID){
return // exit from BJS
}
// ONLY admin can add 100$ to users's balance by it telegramid
tgID = params
let res = Libs.ResourcesLib.anotherUserRes("money", tgID);
res.add(100)
Bot.sendMessage("Added 100$ for user");

Any user can execute any "SECRET" command

For example, you have command /payment (have "Wait for answer") with execute other "secret" command /setBalance :

// command /payment
// user provide oneTime password. If password is valid - add bonus 100$
var oneTimePassword = User.getProperty("oneTimePassword");
if(!oneTimePassword){
return // we have not oneTime password now
}
if(oneTimePassword=="already taked"){
// if taked already - exit
return
}
if(oneTimePassword!=message){
// user do not know oneTime password
Bot.sendMessager("Error. Password is wrong")
}
if(oneTimePassword==message){
// user know oneTime password!
// make it "already taked"
User.setProperty("oneTimePassword", "already taked", "string")
// run "secret" command
Bot.runCommand("/setBalance");
Bot.sendMessage("Thank you for payment!");
}

"Secret" command /setBalance

let res = Libs.ResourcesLib.userRes("money", tgID);
res.add(100)
Bot.sendMessage("Added 100$ for you");

So user must:

  • run /payment command

  • type secret one time password

  • after it - "secret" command "/setBalance" will be runned

Vulnerability: hacker can run /setBalance only and get bonus immediately

Need to checking that command /setBalance was runned only by command /payment

one of the methods - pass secret on run command as params:

command /payment

...
// part of code for /payment
if(oneTimePassword==message){
...
var secret = "GJHURFVJLHF" // use own secret. You can store it in property
Bot.runCommand("/setBalance");
Bot.sendMessage("Thank you for payment!");
}

Do not use "GJHURFVJLHF" secret!

It is not secret world already

command /setBalance

if(params=="GJHURFVJLHF"){
let res = Libs.ResourcesLib.userRes("money", tgID);
res.add(100)
Bot.sendMessage("Added 100$ for you");
}else{
Bot.sendMessage("You are hacker!")
}

Recommendations

Do not share your bot token, BB API Key

Bot token and BB API Key - are is very vulnerability data. Do not share theys anywhere!

Do not use default command names "/onIncome", "/onTransaction" for important commands

Hacker can brute force such command names and try to execute it

Remove /test command

If you have any /test command with non security BJS - remove it.

Hacker can execute /test too

Use completed_commands_count variable

Anybody can run any command. But it is possible make secured sub command.

For example command /admin

// make admin access here
// ...
Bot.runCommand("/secure")

command /secure

// this command can not be runned by user
if(completed_commands_count==0){ return }
// only via Bot.runCommand, Bot.run or as "on_result"
// your secure code here
// ...

Do not use any non official libs now.

Do not use any non official libs now.

  • Any lib can run command with options.

  • Any libs can read properties (and read your API Keys from other lib)

We have not way to protect this now. Just not use NON official libs with CP lib. Well, that now there are no such libraries

Bad practice

Bad BJS:

let admin = "Jon Smith";
if (user.first_name==admin){
// do admin action here
...
}

Any user can set any first_name, last_name and etc

Hacker can change or create account with this field

See BB reports

Read info about BB report. Demo report have nice recommendations.