Skip to content

🛡️ Sentinel: [security improvement] #87

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
DerUntote wants to merge 1 commit into
base: master
Choose a base branch
from
Open

🛡️ Sentinel: [security improvement] #87

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
## 2024-07-02 - Fix Stack Trace Leakage via Discord Logging
**Vulnerability:** The application was appending `e.stack` to `msgTxt` which was then sent to a Discord channel if `config.debug` was true. This could leak internal file paths and execution context to anyone with access to that channel.
**Learning:** Error logs intended for moderation channels must be sanitized. Internal stack traces should be logged locally (e.g. `console.error`) rather than broadcasted to external platforms, even within moderation channels.
**Prevention:** Avoid passing raw `e.stack` or `err.stack` to `channel.send()` or `message.reply()`. Always output errors meant for developers to `console.error()` or a secure logging service, and send generic error messages to users.
123 changes: 60 additions & 63 deletions bot/bot.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,25 +12,27 @@ config = config.get('bot');
var aliases;
// check if any aliases are defined
try {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
aliases = require('./alias.json');
console.log('[' + time + ' PST][' + pm2Name + '] ' + Object.keys(aliases).length + ' aliases Loaded!');
console.log(
'[' +
time +
' PST][' +
pm2Name +
'] ' +
Object.keys(aliases).length +
' aliases Loaded!',
);
} catch (e) {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log('[' + time + ' PST][' + pm2Name + '] No aliases defined');
}
var commands = {};

var bot = new Discord.Client();

bot.on('ready', function() {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
bot.on('ready', function () {
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log(
'[' +
time +
Expand All @@ -40,21 +42,19 @@ bot.on('ready', function() {
bot.user.username +
'Logged in! Serving in ' +
bot.guilds.size + // ⚡ Bolt: O(1) property lookup vs O(N) array creation
' servers'
' servers',
);
bot.channels.get(logChannel).send(
'[' +
time +
' PST][' +
pm2Name +
'] ' +
bot.user.username +
'Logged in! Serving in ' +
bot.guilds.size + // ⚡ Bolt: O(1) property lookup vs O(N) array creation
' servers',
);
bot.channels
.get(logChannel)
.send(
'[' +
time +
' PST][' +
pm2Name +
'] ' +
bot.user.username +
'Logged in! Serving in ' +
bot.guilds.size + // ⚡ Bolt: O(1) property lookup vs O(N) array creation
' servers'
);
require('./plugins.js').init();
console.log(
'[' +
Expand All @@ -63,7 +63,7 @@ bot.on('ready', function() {
pm2Name +
'] type ' +
config.prefix +
'tiphelp in Discord for a commands list.'
'tiphelp in Discord for a commands list.',
);
bot.channels
.get(logChannel)
Expand All @@ -74,10 +74,19 @@ bot.on('ready', function() {
pm2Name +
'] type ' +
config.prefix +
'tiphelp in Discord for a commands list.'
'tiphelp in Discord for a commands list.',
);
bot.user.setActivity(config.prefix + 'Intialized!');
var text = ['tiprvn', 'tipdoge', 'tiplbc', 'tipufo', 'tipproton', 'tippxc', 'tipftc', 'tiphelp'];
var text = [
'tiprvn',
'tipdoge',
'tiplbc',
'tipufo',
'tipproton',
'tippxc',
'tipftc',
'tiphelp',
];
var counter = 0;
setInterval(change, 10000);

Expand All @@ -90,40 +99,32 @@ bot.on('ready', function() {
}
});

process.on('uncaughtException', err => {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
process.on('uncaughtException', (err) => {
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log('[' + time + ' PST][' + pm2Name + '] uncaughtException: ' + err);
bot.channels
.get(logChannel)
.send('[' + time + ' PST][' + pm2Name + '] uncaughtException: ' + err);
process.exit(1); //exit node.js with an error
});

process.on('unhandledRejection', err => {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
process.on('unhandledRejection', (err) => {
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log('[' + time + ' PST][' + pm2Name + '] unhandledRejection: ' + err);
bot.channels
.get(logChannel)
.send('[' + time + ' PST][' + pm2Name + '] unhandledRejection: ' + err);
process.exit(1); //exit node.js with an error
});

bot.on('disconnected', function() {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
bot.on('disconnected', function () {
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log('[' + time + ' PST][' + pm2Name + '] Disconnected!');
process.exit(1); //exit node.js with an error
});

bot.on('error', function(error) {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
bot.on('error', function (error) {
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log('[' + time + ' PST][' + pm2Name + '] error: ' + error);
process.exit(1); //exit node.js with an error
});
Expand All @@ -139,29 +140,29 @@ function checkMessageForCommand(msg, isEdit) {
) {
msg.author
.send('Please set your Discord Presence to Online to talk to the bot!')
.catch(function(error) {
.catch(function (error) {
msg.channel
.send(
msg.author +
', Please enable Direct Messages from server members to communicate fully with our bot, it is located in the user setting area under Privacy & Safety tab, select the option allow direct messages from server members'
', Please enable Direct Messages from server members to communicate fully with our bot, it is located in the user setting area under Privacy & Safety tab, select the option allow direct messages from server members',
)
.then(
msg.channel.send(
'Please set your Discord Presence to Online to talk to the Bot!'
)
'Please set your Discord Presence to Online to talk to the Bot!',
),
);
return;
});
}
var cmdTxt = msg.content.split(' ')[0].substring(config.prefix.length);
var suffix = msg.content.substring(
cmdTxt.length + config.prefix.length + 1
cmdTxt.length + config.prefix.length + 1,
); //add one for the ! and one for the space
if (msg.isMentioned(bot.user)) {
try {
cmdTxt = msg.content.split(' ')[1];
suffix = msg.content.substring(
bot.user.mention().length + cmdTxt.length + config.prefix.length + 1
bot.user.mention().length + cmdTxt.length + config.prefix.length + 1,
);
} catch (e) {
//no command
Expand All @@ -182,15 +183,15 @@ function checkMessageForCommand(msg, isEdit) {
msg.content +
' from ' +
msg.author.username +
' as command'
' as command',
);
try {
cmd.process(bot, msg, suffix, isEdit);
} catch (e) {
var msgTxt = 'command ' + cmdTxt + ' failed :(';
var linebreak = '\n-------------------------------------------------\n';
if (config.debug) {
msgTxt += '\n' + e.stack;
console.error(e);
}
var time = moment()
.tz('America/Los_Angeles')
Expand All @@ -214,37 +215,33 @@ function checkMessageForCommand(msg, isEdit) {
}
}

bot.on('message', msg => checkMessageForCommand(msg, false));
bot.on('message', (msg) => checkMessageForCommand(msg, false));

exports.addCommand = function(commandName, commandObject) {
exports.addCommand = function (commandName, commandObject) {
try {
commands[commandName] = commandObject;
} catch (err) {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log('[' + time + ' PST][' + pm2Name + '] Error addCommand: ' + err);
bot.channels
.get(logChannel)
.send('[' + time + ' PST][' + pm2Name + '] Error addCommand: ' + err);
}
};
exports.addCustomFunc = function(customFunc) {
exports.addCustomFunc = function (customFunc) {
try {
customFunc(bot);
} catch (err) {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log(
'[' + time + ' PST][' + pm2Name + '] Error addCustomFunc: ' + err
'[' + time + ' PST][' + pm2Name + '] Error addCustomFunc: ' + err,
);
bot.channels
.get(logChannel)
.send('[' + time + ' PST][' + pm2Name + '] Error addCustomFunc: ' + err);
}
};
exports.commandCount = function() {
exports.commandCount = function () {
return Object.keys(commands).length;
};

Expand Down
15 changes: 12 additions & 3 deletions bot/modules/dogeTipper.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,10 @@ function doWithdraw(message, tipper, words, helpmsg) {
}
doge.sendFrom(tipper, address, Number(amount), function (err, txId) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
message
.reply('An error occurred.')
.then((message) => message.delete(10000).catch(() => {}));
} else {
message.channel.send({
embed: {
Expand Down Expand Up @@ -263,7 +266,10 @@ function doTip(bot, message, tipper, words, helpmsg) {
function sendDOGE(bot, message, tipper, recipient, amount, privacyFlag) {
getAddress(recipient.toString(), function (err, address) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
message
.reply('An error occurred.')
.then((message) => message.delete(10000).catch(() => {}));
} else {
doge.sendFrom(
tipper,
Expand All @@ -274,7 +280,10 @@ function sendDOGE(bot, message, tipper, recipient, amount, privacyFlag) {
null,
function (err, txId) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
message
.reply('An error occurred.')
.then((message) => message.delete(10000).catch(() => {}));
} else {
if (privacyFlag) {
let userProfile = message.guild.members.get(recipient); // ⚡ Bolt: O(1) direct ID lookup vs O(N) linear search;
Expand Down
6 changes: 3 additions & 3 deletions bot/modules/exampleTipper.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,7 @@ function doWithdraw(message, tipper, words, helpmsg) {
}
ltc.sendFrom(tipper, address, Number(amount), function(err, txId) {
if (err) {
message.reply(err.message).then(message => message.delete(10000));
console.error(err); message.reply('An error occurred.').then((message) => message.delete(10000).catch(() => {}));
} else {
message.channel.send({embed:{
title: '**:outbox_tray::money_with_wings::moneybag:Litecoin (LTC) Transaction Completed!:moneybag::money_with_wings::outbox_tray:**',
Expand Down Expand Up @@ -228,11 +228,11 @@ function doTip(bot, message, tipper, words, helpmsg) {
function sendLTC(bot, message, tipper, recipient, amount, privacyFlag) {
getAddress(recipient.toString(), function(err, address) {
if (err) {
message.reply(err.message).then(message => message.delete(10000));
console.error(err); message.reply('An error occurred.').then((message) => message.delete(10000).catch(() => {}));
} else {
ltc.sendFrom(tipper, address, Number(amount), 1, null, null, function(err, txId) {
if (err) {
message.reply(err.message).then(message => message.delete(10000));
console.error(err); message.reply('An error occurred.').then((message) => message.delete(10000).catch(() => {}));
} else {
if (privacyFlag) {
let userProfile = message.guild.members.get(recipient) // ⚡ Bolt: O(1) direct ID lookup vs O(N) linear search;
Expand Down
15 changes: 12 additions & 3 deletions bot/modules/ftcTipper.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,10 @@ function doWithdraw(message, tipper, words, helpmsg) {
}
ftc.sendFrom(tipper, address, Number(amount), function (err, txId) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
message
.reply('An error occurred.')
.then((message) => message.delete(10000).catch(() => {}));
} else {
message.channel.send({
embed: {
Expand Down Expand Up @@ -263,7 +266,10 @@ function doTip(bot, message, tipper, words, helpmsg) {
function sendFTC(bot, message, tipper, recipient, amount, privacyFlag) {
getAddress(recipient.toString(), function (err, address) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
message
.reply('An error occurred.')
.then((message) => message.delete(10000).catch(() => {}));
} else {
ftc.sendFrom(
tipper,
Expand All @@ -274,7 +280,10 @@ function sendFTC(bot, message, tipper, recipient, amount, privacyFlag) {
null,
function (err, txId) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
message
.reply('An error occurred.')
.then((message) => message.delete(10000).catch(() => {}));
} else {
if (privacyFlag) {
let userProfile = message.guild.members.get(recipient); // ⚡ Bolt: O(1) direct ID lookup vs O(N) linear search;
Expand Down
Loading