Update send-text-message-or-reply.mjs #18775
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
|
Thank you so much for submitting this! We've added it to our backlog to review, and our team has been notified. |
WalkthroughRewrote the Telegram send-text-message-or-reply action from a metadata-based export to an async function that posts directly to Telegram’s sendMessage API via axios. The function extracts text from event.body, uses hardcoded token and chat_id, and returns API data or an error object. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant C as Caller
participant F as sendTextMessageOrReply(event)
participant T as Telegram API (sendMessage)
rect rgb(240,248,255)
note over F: Extract message from event.body
C->>F: event
F->>T: POST /bot{token}/sendMessage<br/>chat_id, text
end
alt Success
T-->>F: 200 OK + data
F-->>C: response.data
else Error
T-->>F: Error
F-->>C: { error: error.message }
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (1 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Thanks for submitting this PR! When we review PRs, we follow the Pipedream component guidelines. If you're not familiar, here's a quick checklist:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
components/telegram_bot_api/actions/send-text-message-or-reply/send-text-message-or-reply.mjs(1 hunks)
🧰 Additional context used
🪛 Gitleaks (8.28.0)
components/telegram_bot_api/actions/send-text-message-or-reply/send-text-message-or-reply.mjs
[high] 4-4: Detected a Telegram Bot API Token, risking unauthorized bot operations and message interception on Telegram.
(telegram-bot-api-token)
| export default async function(event) { | ||
| const telegramToken = "8469316973:AAHawOsGOdQ1alVIPy8FpUW3yN-GoJbpcK4"; | ||
| const chatId = "8409601106"; | ||
|
|
||
| // الرسالة اللي جت من TradingView | ||
| const message = event.body.text || JSON.stringify(event.body); | ||
|
|
||
| const url = `https://api.telegram.org/bot${telegramToken}/sendMessage`; | ||
|
|
||
| try { | ||
| const response = await axios.post(url, { | ||
| chat_id: chatId, | ||
| text: message, | ||
| parse_mode: "Markdown" | ||
| }); | ||
| // eslint-disable-next-line multiline-ternary | ||
| $.export("$summary", `Successfully sent a ${this.reply_to_message_id ? "reply" : "text message"} to chat, "${this.chatId}"`); | ||
| return resp; | ||
| }, | ||
| }; | ||
| return response.data; | ||
| } catch (error) { | ||
| return { error: error.message }; | ||
| } | ||
| } |
There was a problem hiding this comment.
Restore the Pipedream component export.
This file must export the Pipedream action/component object (name, props, run, etc.). Replacing it with a bare async function removes the metadata and breaks runtime execution + UI integration, so the action will fail to load. Please revert to the component export structure and reapply any logic inside the run method instead.
🧰 Tools
🪛 Gitleaks (8.28.0)
[high] 4-4: Detected a Telegram Bot API Token, risking unauthorized bot operations and message interception on Telegram.
(telegram-bot-api-token)
| const telegramToken = "8469316973:AAHawOsGOdQ1alVIPy8FpUW3yN-GoJbpcK4"; | ||
| const chatId = "8409601106"; |
There was a problem hiding this comment.
Remove hardcoded Telegram credentials.
A real bot token (and chat ID) is embedded in source. That leaks control of the bot, violates our secret-handling policy, and was flagged by gitleaks. Retrieve the token/chat ID from a prop or managed auth (e.g. auth/props) and scrub the committed secret immediately (revoke the token on Telegram).
🧰 Tools
🪛 Gitleaks (8.28.0)
[high] 4-4: Detected a Telegram Bot API Token, risking unauthorized bot operations and message interception on Telegram.
(telegram-bot-api-token)
🤖 Prompt for AI Agents
In
components/telegram_bot_api/actions/send-text-message-or-reply/send-text-message-or-reply.mjs
around lines 4 to 5, remove the hardcoded Telegram bot token and chat ID and
instead read them from a secure source (preferably injected via props or an auth
object, or environment variables) with validation and clear error handling when
missing; ensure the implementation never logs or commits the raw secret, update
callers to pass the token/chatId through props/auth, and revoke the embedded
token in Telegram immediately to scrub the secret from production.
3 participants
WHY
Summary by CodeRabbit
Bug Fixes
Enhancements
Refactor