YoursFunny 4d6ec7924b fix(handlers): escape user-supplied text in log lines ...

A Telegram display name, callback payload or channel handle is attacker-controlled text, and it went straight into info/error lines: one embedded newline forged a second log entry, and control characters could hide inside a line (log injection, audit SEC-006). handlers::log_escape replaces newlines, carriage returns and other control characters with visible escapes — clean input borrows, so logging allocates nothing extra — and every site that prints such a value uses it: the callback arrival line, the set-forward-channel info line (name + handle) and both get_chat error lines. The test pins that no raw newline can survive; AGENTS' logging convention names the helper.

2026-09-24 15:02:31 +08:00

..

x-media

refactor(download): fold apply_media_headers into media_request

2026-09-24 04:37:54 +08:00

xmedia-bot

fix(handlers): escape user-supplied text in log lines

2026-09-24 15:02:31 +08:00