Validate Telegram path form and require long proxy secret

lumen_telegram_transport.py

@@ -151,8 +151,8 @@ def proxy_auth_middlewares(
         if parsed.hostname in {"api.telegram.org", "www.tikwm.com", "tikwm.com"}:
             continue
         scopes.append((parsed.hostname, port, parsed.path.rstrip("/")))
-    if scopes and (not proxy_secret or any(not 33 <= ord(c) <= 126 for c in proxy_secret)):
-        raise ValueError("LUMEN_PROXY_SECRET is required for configured proxies and must be printable ASCII without spaces")
+    if scopes and (not proxy_secret or len(proxy_secret) < 32 or any(not 33 <= ord(c) <= 126 for c in proxy_secret)):
+        raise ValueError("LUMEN_PROXY_SECRET is required for configured proxies (min 32 printable ASCII chars without spaces)")
 
     async def authenticate(request: aiohttp.ClientRequest, handler):
         request.headers.popall(PROXY_AUTH_HEADER, None)

proxy/proxy.ts

@@ -54,6 +54,10 @@ export const ALLOWED_HOSTS = new Set([
 // под честно большие файлы, но не «без предела».
 export const MAX_REQUEST_BODY_BYTES = 100 * 1024 * 1024;
 
+// Короткий секрет перебирается быстро: нижняя граница длины с обеих сторон
+// (здесь и в lumen_telegram_transport.py).
+export const MIN_PROXY_SECRET_LENGTH = 32;
+
 export class BodyTooLargeError extends Error {}
 
 export function limitStreamBytes(
@@ -133,9 +137,18 @@ export function resolveTarget(pathname: string, search: string): TargetResolutio
     return { ok: false, status: 403, message: "Host not allowed" };
   }
   const path = "/" + parts.slice(3).join("/");
+  if (host === "api.telegram.org" && !isTelegramBotPath(path)) {
+    return { ok: false, status: 404, message: "Not found — путь Telegram обязан иметь форму /bot<token>/<метод> или /file/bot<token>/<путь>" };
+  }
   return { ok: true, url: `https://${host}${path}${search}` };
 }
 
+// Telegram Bot API без токена в пути не вызывается: без формы исчезает целый
+// класс чужеродного использования (релей произвольных путей при наличии секрета).
+function isTelegramBotPath(path: string): boolean {
+  return /^\/bot[^/]+\/.+/.test(path) || /^\/file\/bot[^/]+\/.+/.test(path);
+}
+
 export function buildForwardHeaders(reqHeaders: Headers): Headers {
   const headers = new Headers(reqHeaders);
   for (const name of HOP_BY_HOP_REQUEST_HEADERS) headers.delete(name);
@@ -158,7 +171,10 @@ export async function handleRequest(
   proxySecret: string | undefined = undefined,
   maxBodyBytes: number = MAX_REQUEST_BODY_BYTES,
 ): Promise<Response> {
-  if (!proxySecret || !/^[\x21-\x7e]+$/.test(proxySecret)) {
+  if (
+    !proxySecret || proxySecret.length < MIN_PROXY_SECRET_LENGTH ||
+    !/^[\x21-\x7e]+$/.test(proxySecret)
+  ) {
     return new Response("Proxy authentication unavailable", { status: 503 });
   }
   const suppliedSecret = req.headers.get(PROXY_AUTH_HEADER) ?? "";

proxy/proxy_test.ts

@@ -16,7 +16,7 @@ import {
   resolveTarget,
 } from "./proxy.ts";
 
-const TEST_SECRET = "isolated-test-secret";
+const TEST_SECRET = "isolated-test-secret-0123456789abcdef";
 const AUTH_HEADERS = { [PROXY_AUTH_HEADER]: TEST_SECRET };
 
 function assert(condition: boolean, message: string): void {
@@ -89,6 +89,18 @@ Deno.test("resolveTarget отклоняет некорректный форма
   assertEquals(resolveTarget("/wrong-prefix/api.telegram.org/getMe", "").ok, false);
 });
 
+Deno.test("resolveTarget требует форму bot-пути для api.telegram.org", () => {
+  // Без токена в пути — не релей: произвольные пути при наличии секрета закрыты.
+  assertEquals(resolveTarget("/fetch/api.telegram.org/getMe", "").ok, false);
+  assertEquals(resolveTarget("/fetch/api.telegram.org/evil", "").ok, false);
+  assertEquals(resolveTarget("/fetch/api.telegram.org/bot", "").ok, false);
+  // Легитимные формы бота проходят.
+  assertEquals(resolveTarget("/fetch/api.telegram.org/bot123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11/getMe", "").ok, true);
+  assertEquals(resolveTarget("/fetch/api.telegram.org/file/bot123/photos/f.jpg", "").ok, true);
+  // Чужим хостам форма не нужна.
+  assertEquals(resolveTarget("/fetch/www.tikwm.com/api/", "").ok, true);
+});
+
 Deno.test("ALLOWED_HOSTS содержит ровно те хосты, что реально нужны боту", () => {
   assertEquals(ALLOWED_HOSTS.has("api.telegram.org"), true);
   assertEquals(ALLOWED_HOSTS.has("www.tikwm.com"), true);
@@ -186,7 +198,7 @@ Deno.test("handleRequest возвращает 502, если апстрим-fetch
   const fakeFetch: typeof fetch = () => {
     throw new Error(`network unreachable ${TEST_SECRET}`);
   };
-  const req = new Request("https://proxy.example/fetch/api.telegram.org/getMe", { method: "GET", headers: AUTH_HEADERS });
+  const req = new Request("https://proxy.example/fetch/api.telegram.org/bot123/getMe", { method: "GET", headers: AUTH_HEADERS });
   const resp = await handleRequest(req, fakeFetch, TEST_SECRET);
   assertEquals(resp.status, 502);
   assertEquals(await resp.text(), "Upstream fetch failed");
@@ -209,7 +221,7 @@ for (const suppliedSecret of [undefined, "", "incorrect-test-secret"]) {
   });
 }
 
-for (const configuredSecret of [undefined, "", "   ", "invalid secret"]) {
+for (const configuredSecret of [undefined, "", "   ", "invalid secret", "short"]) {
   Deno.test(`handleRequest fails closed for invalid configuration: ${String(configuredSecret)}`, async () => {
     let fetchCalled = false;
     const fakeFetch: typeof fetch = () => {
@@ -376,7 +388,7 @@ Deno.test("handleRequest требует от апстрима не следов
     capturedRedirect = init?.redirect;
     return Promise.resolve(new Response('{"ok":true}', { status: 200 }));
   };
-  const req = new Request("https://proxy.example/fetch/api.telegram.org/getMe", { headers: AUTH_HEADERS });
+  const req = new Request("https://proxy.example/fetch/api.telegram.org/bot123/getMe", { headers: AUTH_HEADERS });
   await handleRequest(req, fakeFetch, TEST_SECRET);
   assertEquals(capturedRedirect, "error");
 });
@@ -388,7 +400,7 @@ Deno.test("handleRequest терпит кривой content-length (NaN/отри
     return Promise.resolve(new Response('{"ok":true}', { status: 200 }));
   };
   for (const declared of ["abc", "-5"]) {
-    const req = new Request("https://proxy.example/fetch/api.telegram.org/getMe", {
+    const req = new Request("https://proxy.example/fetch/api.telegram.org/bot123/getMe", {
       headers: { ...AUTH_HEADERS, "content-length": declared },
     });
     assertEquals((await handleRequest(req, fakeFetch, TEST_SECRET)).status, 200);

tests/bot_test_helpers.py

@@ -447,7 +447,7 @@ class _FakeProc:
         return self.returncode
 
 
-def _run_proxy_middleware(url, *, secret="proxy-secret-abc", bases=("https://proxy.example/fetch/api.telegram.org",), headers=None):
+def _run_proxy_middleware(url, *, secret="proxy-secret-abc-0123456789abcdef", bases=("https://proxy.example/fetch/api.telegram.org",), headers=None):
     from multidict import CIMultiDict
     from yarl import URL
 

tests/test_bot_transport.py

@@ -229,7 +229,7 @@ def test_tikwm_proxy_candidates_primary_plus_fallbacks_deduped():
 
 def test_proxy_middleware_sends_secret_only_to_configured_proxy():
     _, _, seen = _run_proxy_middleware("https://proxy.example/fetch/api.telegram.org/bot123/sendMessage")
-    assert seen["sent"].get("X-Lumen-Proxy-Secret") == "proxy-secret-abc"
+    assert seen["sent"].get("X-Lumen-Proxy-Secret") == "proxy-secret-abc-0123456789abcdef"
 
 
 def test_proxy_middleware_never_sends_secret_to_direct_or_unrelated_hosts():
@@ -254,6 +254,11 @@ def test_proxy_middleware_strips_stale_secret_and_requires_secret():
         lumen_telegram_transport.proxy_auth_middlewares(
             proxy_secret="", proxy_base_urls=("https://proxy.example/fetch/api.telegram.org",),
         )
+    with pytest.raises(ValueError):
+        lumen_telegram_transport.proxy_auth_middlewares(
+            proxy_secret="short",
+            proxy_base_urls=("https://proxy.example/fetch/api.telegram.org",),
+        )
 
 
 def test_proxy_middleware_rejects_authenticated_redirects():
@@ -264,7 +269,7 @@ def test_proxy_middleware_rejects_authenticated_redirects():
     from yarl import URL
 
     (authenticate,) = lumen_telegram_transport.proxy_auth_middlewares(
-        proxy_secret="proxy-secret-abc",
+        proxy_secret="proxy-secret-abc-0123456789abcdef",
         proxy_base_urls=("https://proxy.example/fetch/api.telegram.org",),
     )