T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/bot.py:91- Finding
Unrestricted Bot Access Permits Abuse of the Owner's Paid OpenAI API
- Content
View full analysis
None: """Sprachnachricht oder Audio transkribieren.""" msg = update.message audio = msg.voice or msg.audio or msg.video_note if not audio: return log.info("Audio empfangen von %s (%d bytes)", msg.from_user.first_name, audio.file_size or 0) try: # Datei von Telegram herunterladen tg_file = await audio.get_file() suffix = ".ogg" if msg.audio and msg.audio.file_name: suffix = Path(msg.audio.file_name).suffix or ".ogg" with tempfile.NamedTemporaryFile(suffix=suffix, delete=False) as tmp: tmp_path = tmp.name await tg_file.download_to_drive(tmp_path) log.info("Transkribiere %s ...", tmp_path) # Whisper API aufrufen with open(tmp_path, "rb") as f: transcript = client.audio.transcriptions.create( model="whisper-1", file=f, response_format="text", ) # Aufräumen os.unlink(tmp_path) text = transcript.strip() if isinstance(transcript, str) else transcript.text.strip() if text: await msg.reply_text(text) log.info("Transkription gesendet (%d Zeichen)", len(text)) else: await msg.reply_text("(Keine Sprache erkannt)") ``` ```python app.add_handler(CommandHandler("start", handle_start)) app.add_handler(MessageHandler(filters.VOICE | filters.AUDIO | filters.VIDEO_NOTE, handle_voice)) app.add_handler(MessageHandler(filters.TEXT & ~filters.COMMAND, handle_text)) ``` ### Technical Analysis The media handler is registered for every Telegram user who can contact the bot. It does not verify ...[truncated 1850 chars]- Remediation
View remediation
None: msg = update.effective_message user = update.effective_user if not user or user.id not in ALLOWED_USER_IDS: log.warning("Rejected unauthorized Telegram user ID") return # Continue only after authorization. ``` ]]>