Fix bugs and security issues (backward compatible)

composer.json

@@ -2,7 +2,7 @@
   "name": "neneone/snapebot",
   "description": "PHP class-based framework to create Telegram Bots using webhook.",
   "type": "project",
-  "license": "AGPL-3.0-only",
+  "license": "GPL-3.0-or-later",
   "keywords": [
     "telegram",
     "bot",
@@ -23,7 +23,7 @@
     "ext-pdo": "*",
     "ext-json": "*"
   },
-  "minimum-stability": "dev",
+  "minimum-stability": "stable",
   "autoload": {
     "psr-4": {
       "neneone\\SnapeBot\\": "src/"

src/DatabaseManager.php

@@ -25,7 +25,9 @@ trait DatabaseManager
     public function connectToDatabase($host, $databaseName, $username, $password)
     {
         try {
-            $db = new \PDO('mysql:host='.$host.';dbname='.$databaseName, $username, $password);
+            $db = new \PDO('mysql:host='.$host.';dbname='.$databaseName.';charset=utf8mb4', $username, $password, [
+                \PDO::ATTR_ERRMODE => \PDO::ERRMODE_EXCEPTION,
+            ]);
         } catch (\PDOException $e) {
             throw new \neneone\SnapeBot\Exception('PDOException during connection to database', 0, $e);
         }
@@ -71,6 +73,9 @@ public function setPage($page = '', $userID = false, $field = 'page') {
       if($userID == false) {
         if(isset($this->userID)) $userID = $this->userID; else throw new Exception('Missing userID while required in setPage');
       }
+      if (!preg_match('/^[A-Za-z0-9_]+$/', $field)) {
+        throw new Exception('Invalid field name in setPage.');
+      }
       $q = $this->db->prepare('UPDATE '.$this->tName.' SET ' . $field . ' = :page WHERE userID = :userID');
       $q->bindParam(':page', $page);
       $q->bindParam(':userID', $userID);

src/SnapeBot.php

@@ -114,9 +114,15 @@ public function __construct($botToken, $update, $settings = [])
         $this->botToken = $botToken;
         $this->botUsername = $this->settings['botUsername'];
         $this->tName = is_array($this->settings['database']) ? ($this->settings['database']['tableName'] ?? 'SnapeBot') : 'SnapeBot';
+        if (!preg_match('/^[A-Za-z0-9_]+$/', $this->tName)) {
+            throw new Exception('Invalid table name. Only letters, numbers and underscores are allowed.');
+        }
+        if ($this->settings['cbDataEncryption'] && ('SnapeBotKey2019' === $this->settings['encryptionData']['key'] || 'SnapeBotAwesomeIV2019' === $this->settings['encryptionData']['iv'])) {
+            trigger_error('SnapeBot: cbDataEncryption is enabled but the default encryption key/iv are in use. Set your own "encryptionData" key and iv, otherwise the callback data encryption is not secure.', E_USER_WARNING);
+        }
 
         if ($this->settings['getBotInformations'] || !isset($this->settings['botUsername'])) {
-            $getMe = (new \neneone\snapeBot\BotAPI($botToken))->getMe();
+            $getMe = (new \neneone\SnapeBot\BotAPI($botToken))->getMe();
             if (isset($getMe['result']['username'])) {
                 $this->botInformations = $getMe['result'];
                 $this->settings['botUsername'] = $this->botInformations['username'];
@@ -145,6 +151,7 @@ public static function buildSettings($settings, $settingsScheme = false)
         if ($settingsScheme == false) {
             $settingsScheme = self::$settingsScheme;
         }
+        $builtSettings = [];
         foreach ($settingsScheme as $setting => $structure) {
             if (!isset($settings[$setting]) && true == $structure['required']) {
                 throw new Exception('Missing required setting: '.$setting.'.');
@@ -263,14 +270,27 @@ private function firstRun()
     public function specialEncrypt($string)
     {
         $key = hash('sha256', $this->settings['encryptionData']['key']);
-        $iv = substr(hash('sha256', $this->settings['encryptionData']['iv']), 0, 16);
+        $iv = openssl_random_pseudo_bytes(16);
+        $cipher = openssl_encrypt($string, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv);
 
-        return base64_encode(openssl_encrypt($string, 'AES-256-CBC', $key, 0, $iv));
+        // The leading '!' marks the new format (random IV prepended to the
+        // ciphertext). '!' is not part of the base64 alphabet, so it can never
+        // collide with data produced by older versions.
+        return '!'.base64_encode($iv.$cipher);
     }
 
     public function specialDecrypt($string)
     {
         $key = hash('sha256', $this->settings['encryptionData']['key']);
+        if (isset($string[0]) && '!' === $string[0]) {
+            $raw = base64_decode(substr($string, 1));
+            $iv = substr($raw, 0, 16);
+            $cipher = substr($raw, 16);
+
+            return openssl_decrypt($cipher, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv);
+        }
+
+        // Backward compatibility: data encrypted by older versions used a fixed IV.
         $iv = substr(hash('sha256', $this->settings['encryptionData']['iv']), 0, 16);
 
         return openssl_decrypt(base64_decode($string), 'AES-256-CBC', $key, 0, $iv);

src/VariablesMaker.php

@@ -275,7 +275,7 @@ public function parseMessage($message)
             $r['connectedWebsite'] = $message['connected_website'];
         }
         if (isset($message['passport_data'])) {
-            $r['passportData'] = $this->parsePassport($message['passport_data']);
+            $r['passportData'] = $this->parsePassportData($message['passport_data']);
         }
         if (isset($message['reply_markup'])) {
             $r['replyMarkup'] = $message['reply_markup'];