Skip to content

🛡️ Sentinel: [security improvement] #85

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
DerUntote wants to merge 1 commit into
base: master
Choose a base branch
from
Open

🛡️ Sentinel: [security improvement] #85

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
## 2024-07-01 - Prevent Exposing Server Paths in Discord Logs
**Vulnerability:** Error stack traces were being appended to Discord moderation channel messages when `config.debug` is enabled, exposing server file paths.
**Learning:** Even internal moderation channels shouldn't receive raw stack traces, as they leak server structure.
**Prevention:** Always log stack traces internally via `console.error()` and send only generic error messages to Discord APIs.
124 changes: 61 additions & 63 deletions bot/bot.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,25 +12,27 @@ config = config.get('bot');
var aliases;
// check if any aliases are defined
try {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
aliases = require('./alias.json');
console.log('[' + time + ' PST][' + pm2Name + '] ' + Object.keys(aliases).length + ' aliases Loaded!');
console.log(
'[' +
time +
' PST][' +
pm2Name +
'] ' +
Object.keys(aliases).length +
' aliases Loaded!',
);
} catch (e) {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log('[' + time + ' PST][' + pm2Name + '] No aliases defined');
}
var commands = {};

var bot = new Discord.Client();

bot.on('ready', function() {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
bot.on('ready', function () {
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log(
'[' +
time +
Expand All @@ -40,21 +42,19 @@ bot.on('ready', function() {
bot.user.username +
'Logged in! Serving in ' +
bot.guilds.size + // ⚡ Bolt: O(1) property lookup vs O(N) array creation
' servers'
' servers',
);
bot.channels.get(logChannel).send(
'[' +
time +
' PST][' +
pm2Name +
'] ' +
bot.user.username +
'Logged in! Serving in ' +
bot.guilds.size + // ⚡ Bolt: O(1) property lookup vs O(N) array creation
' servers',
);
bot.channels
.get(logChannel)
.send(
'[' +
time +
' PST][' +
pm2Name +
'] ' +
bot.user.username +
'Logged in! Serving in ' +
bot.guilds.size + // ⚡ Bolt: O(1) property lookup vs O(N) array creation
' servers'
);
require('./plugins.js').init();
console.log(
'[' +
Expand All @@ -63,7 +63,7 @@ bot.on('ready', function() {
pm2Name +
'] type ' +
config.prefix +
'tiphelp in Discord for a commands list.'
'tiphelp in Discord for a commands list.',
);
bot.channels
.get(logChannel)
Expand All @@ -74,10 +74,19 @@ bot.on('ready', function() {
pm2Name +
'] type ' +
config.prefix +
'tiphelp in Discord for a commands list.'
'tiphelp in Discord for a commands list.',
);
bot.user.setActivity(config.prefix + 'Intialized!');
var text = ['tiprvn', 'tipdoge', 'tiplbc', 'tipufo', 'tipproton', 'tippxc', 'tipftc', 'tiphelp'];
var text = [
'tiprvn',
'tipdoge',
'tiplbc',
'tipufo',
'tipproton',
'tippxc',
'tipftc',
'tiphelp',
];
var counter = 0;
setInterval(change, 10000);

Expand All @@ -90,40 +99,32 @@ bot.on('ready', function() {
}
});

process.on('uncaughtException', err => {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
process.on('uncaughtException', (err) => {
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log('[' + time + ' PST][' + pm2Name + '] uncaughtException: ' + err);
bot.channels
.get(logChannel)
.send('[' + time + ' PST][' + pm2Name + '] uncaughtException: ' + err);
process.exit(1); //exit node.js with an error
});

process.on('unhandledRejection', err => {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
process.on('unhandledRejection', (err) => {
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log('[' + time + ' PST][' + pm2Name + '] unhandledRejection: ' + err);
bot.channels
.get(logChannel)
.send('[' + time + ' PST][' + pm2Name + '] unhandledRejection: ' + err);
process.exit(1); //exit node.js with an error
});

bot.on('disconnected', function() {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
bot.on('disconnected', function () {
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log('[' + time + ' PST][' + pm2Name + '] Disconnected!');
process.exit(1); //exit node.js with an error
});

bot.on('error', function(error) {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
bot.on('error', function (error) {
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log('[' + time + ' PST][' + pm2Name + '] error: ' + error);
process.exit(1); //exit node.js with an error
});
Expand All @@ -139,29 +140,29 @@ function checkMessageForCommand(msg, isEdit) {
) {
msg.author
.send('Please set your Discord Presence to Online to talk to the bot!')
.catch(function(error) {
.catch(function (error) {
msg.channel
.send(
msg.author +
', Please enable Direct Messages from server members to communicate fully with our bot, it is located in the user setting area under Privacy & Safety tab, select the option allow direct messages from server members'
', Please enable Direct Messages from server members to communicate fully with our bot, it is located in the user setting area under Privacy & Safety tab, select the option allow direct messages from server members',
)
.then(
msg.channel.send(
'Please set your Discord Presence to Online to talk to the Bot!'
)
'Please set your Discord Presence to Online to talk to the Bot!',
),
);
return;
});
}
var cmdTxt = msg.content.split(' ')[0].substring(config.prefix.length);
var suffix = msg.content.substring(
cmdTxt.length + config.prefix.length + 1
cmdTxt.length + config.prefix.length + 1,
); //add one for the ! and one for the space
if (msg.isMentioned(bot.user)) {
try {
cmdTxt = msg.content.split(' ')[1];
suffix = msg.content.substring(
bot.user.mention().length + cmdTxt.length + config.prefix.length + 1
bot.user.mention().length + cmdTxt.length + config.prefix.length + 1,
);
} catch (e) {
//no command
Expand All @@ -182,15 +183,16 @@ function checkMessageForCommand(msg, isEdit) {
msg.content +
' from ' +
msg.author.username +
' as command'
' as command',
);
try {
cmd.process(bot, msg, suffix, isEdit);
} catch (e) {
var msgTxt = 'command ' + cmdTxt + ' failed :(';
var linebreak = '\n-------------------------------------------------\n';
if (config.debug) {
msgTxt += '\n' + e.stack;
// 🛡️ Sentinel: Log stack trace internally to avoid exposing server paths in Discord
console.error(e);
}
var time = moment()
.tz('America/Los_Angeles')
Expand All @@ -214,37 +216,33 @@ function checkMessageForCommand(msg, isEdit) {
}
}

bot.on('message', msg => checkMessageForCommand(msg, false));
bot.on('message', (msg) => checkMessageForCommand(msg, false));

exports.addCommand = function(commandName, commandObject) {
exports.addCommand = function (commandName, commandObject) {
try {
commands[commandName] = commandObject;
} catch (err) {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log('[' + time + ' PST][' + pm2Name + '] Error addCommand: ' + err);
bot.channels
.get(logChannel)
.send('[' + time + ' PST][' + pm2Name + '] Error addCommand: ' + err);
}
};
exports.addCustomFunc = function(customFunc) {
exports.addCustomFunc = function (customFunc) {
try {
customFunc(bot);
} catch (err) {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log(
'[' + time + ' PST][' + pm2Name + '] Error addCustomFunc: ' + err
'[' + time + ' PST][' + pm2Name + '] Error addCustomFunc: ' + err,
);
bot.channels
.get(logChannel)
.send('[' + time + ' PST][' + pm2Name + '] Error addCustomFunc: ' + err);
}
};
exports.commandCount = function() {
exports.commandCount = function () {
return Object.keys(commands).length;
};

Expand Down