T09 · Insecure Skill Coding Practices
Error
- Location
scripts/save_booking.py:297- Finding
Excessive Transmission of Guest Personal Data to Telegram
- Content
View full analysis
None: url = f"https://api.telegram.org/bot{bot_token}/sendMessage" payload = parse.urlencode({ "chat_id": chat_id, "text": text, "disable_web_page_preview": "true", }).encode("utf-8") req = request.Request(url, data=payload, method="POST") with request.urlopen(req, timeout=15) as resp: if resp.status != 200: raise RuntimeError(f"Telegram HTTP {resp.status}") ``` ```python if bot_token and chat_id: text = ( "📌 Новая бронь Парадиз\n" f"Номер брони: {booking_number}\n" f"Статус: {booking_status}\n" f"Гость: {args.guest}\n" f"Телефон: {args.phone}\n" f"Email: {args.email}\n" f"Период: {args.checkin} → {args.checkout}\n" f"Гостей: {args.guests}\n" f"Номер: {args.room}\n" f"Итого: {args.total}\n" f"Предоплата: {args.prepay} ({prepay_state})\n" f"Комментарий: {args.notes or '-'}" ) try: send_telegram(bot_token, chat_id, text) sent = True except Exception as e: err = str(e) ``` ### Technical Analysis When `--notify` is enabled, the script sends a complete booking record to the Telegram Bot API. The transmitted record includes the guest's name, telephone number, email address, travel dates, room details, payment information, and unrestricted notes. Telegram notification is part of the declared workflow, so the network request is not hidden remote exfiltration. However, the payload exceeds data-minimization requirements. The free-form notes field is particularly sensitive because it may contain arrival times, information about children, transportation requirements, or other persona ...[truncated 1211 chars]- Remediation
View remediation