n8n-io/n8n
1
1
Fork 0
mirror of https://github.com/n8n-io/n8n.git synced 2024-09-11 13:15:28 +03:00
Code Issues Projects Releases Wiki Activity

feat(Telegram Trigger Node): Verify Webhook requests (#8383)

Browse Source 
Co-authored-by: Jonathan Bennetts <jonathan.bennetts@gmail.com>
This commit is contained in:
Marcus 2024-01-19 09:09:11 +01:00 committed by GitHub
parent 25f51f4fd7
commit 11176124b5
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 32 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
packages/nodes-base/nodes/Telegram/GenericFunctions.ts
View File

@ -235,3 +235,9 @@ export function getImageBySize(photos: IDataObject[], size: string): IDataObject
export function getPropertyName(operation: string) {
return operation.replace('send', '').toLowerCase();
}
export function getSecretToken(this: IHookFunctions | IWebhookFunctions) {
// Only characters A-Z, a-z, 0-9, _ and - are allowed.
const secret_token = `${this.getWorkflow().id}_${this.getNode().id}`;
return secret_token.replace(/[^a-zA-Z0-9\_\-]+/g, '');
}

28
packages/nodes-base/nodes/Telegram/TelegramTrigger.node.ts
View File

@ -7,7 +7,7 @@ import type {
IWebhookResponseData,
} from 'n8n-workflow';
import { apiRequest, getImageBySize } from './GenericFunctions';
import { apiRequest, getImageBySize, getSecretToken } from './GenericFunctions';
import type { IEvent } from './IEvent';
@ -17,7 +17,8 @@ export class TelegramTrigger implements INodeType {
name: 'telegramTrigger',
icon: 'file:telegram.svg',
group: ['trigger'],
version: 1,
version: [1, 1.1],
defaultVersion: 1.1,
subtitle: '=Updates: {{$parameter["updates"].join(", ")}}',
description: 'Starts the workflow on a Telegram update',
defaults: {
@ -40,6 +41,13 @@ export class TelegramTrigger implements INodeType {
},
],
properties: [
{
displayName:
'Due to Telegram API limitations, you can use just one Telegram trigger for each bot at a time',
name: 'telegramTriggerNotice',
type: 'notice',
default: '',
},
{
displayName: 'Trigger On',
name: 'updates',
@ -188,9 +196,12 @@ export class TelegramTrigger implements INodeType {
const endpoint = 'setWebhook';
const secret_token = getSecretToken.call(this);
const body = {
url: webhookUrl,
allowed_updates: allowedUpdates,
secret_token,
};
await apiRequest.call(this, 'POST', endpoint, body);
@ -216,6 +227,19 @@ export class TelegramTrigger implements INodeType {
const credentials = await this.getCredentials('telegramApi');
const bodyData = this.getBodyData() as IEvent;
const headerData = this.getHeaderData();
const nodeVersion = this.getNode().typeVersion;
if (nodeVersion > 1) {
const secret = getSecretToken.call(this);
if (secret !== headerData['x-telegram-bot-api-secret-token']) {
const res = this.getResponseObject();
res.status(403).json({ message: 'Provided secret is not valid' });
return {
noWebhookResponse: true,
};
}
}
const additionalFields = this.getNodeParameter('additionalFields') as IDataObject;