982165203d
Change-detectors, tautologies, source-reading tests, redundant duplicates, mock-echo tests and dead/unrunnable tests. Per-test rationale in the lane ledger (category + reason for every removal).
51 lines
1.7 KiB
Python
51 lines
1.7 KiB
Python
"""Tests for GHSA-3vpc-7q5r-276h — Telegram webhook secret required.
|
|
|
|
Previously, when TELEGRAM_WEBHOOK_URL was set but TELEGRAM_WEBHOOK_SECRET
|
|
was not, python-telegram-bot received secret_token=None and the webhook
|
|
endpoint accepted any HTTP POST.
|
|
|
|
The fix refuses to start the adapter in webhook mode without the secret.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from unittest.mock import AsyncMock, MagicMock
|
|
|
|
import pytest
|
|
|
|
from gateway.config import PlatformConfig
|
|
from plugins.platforms.telegram.adapter import TelegramAdapter
|
|
|
|
|
|
def _adapter() -> TelegramAdapter:
|
|
adapter = TelegramAdapter(PlatformConfig(enabled=True, token="***"))
|
|
adapter._app = MagicMock()
|
|
adapter._app.updater.start_webhook = AsyncMock()
|
|
return adapter
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
@pytest.mark.parametrize("secret", [None, "", " "], ids=["unset", "empty", "blank"])
|
|
async def test_webhook_mode_refuses_to_start_without_secret(monkeypatch, secret):
|
|
if secret is None:
|
|
monkeypatch.delenv("TELEGRAM_WEBHOOK_SECRET", raising=False)
|
|
else:
|
|
monkeypatch.setenv("TELEGRAM_WEBHOOK_SECRET", secret)
|
|
adapter = _adapter()
|
|
|
|
with pytest.raises(RuntimeError):
|
|
await adapter._start_webhook_mode("https://example.test/telegram", is_reconnect=False)
|
|
|
|
adapter._app.updater.start_webhook.assert_not_awaited()
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_webhook_mode_registers_secret_token(monkeypatch):
|
|
monkeypatch.setenv("TELEGRAM_WEBHOOK_SECRET", " s3cret ")
|
|
adapter = _adapter()
|
|
|
|
await adapter._start_webhook_mode("https://example.test/telegram", is_reconnect=False)
|
|
|
|
adapter._app.updater.start_webhook.assert_awaited_once()
|
|
assert adapter._app.updater.start_webhook.await_args.kwargs["secret_token"] == "s3cret"
|