Error handling and HTML escaping #52

src/db.ts

@@ -1,6 +1,6 @@
 const Database = require('better-sqlite3');
 const db = new Database('./config/support.db', {
-   verbose: console.log }); // debugging
+/* verbose: console.log */ }); // debugging
 
 try {
   db.prepare(

src/error.ts

@@ -1,9 +1,10 @@
 import * as fs from 'fs';
 import * as util from 'util';
+import config from '../config/config';
 const debugFile = './config/debug.log';
 const logStdout = process.stdout;
 
-function init() {
+function init(bot) {
   // overload logging to file
   console.log = function(d) {
     logStdout.write(util.format(d) + '\n');
@@ -23,6 +24,9 @@ function init() {
           if (err) throw err;
         });
     console.error(new Date() + ': ' + 'Error: ', err);
+    bot.telegram.sendMessage(
+        config.staffchat_id, `An error occured, please report this to your admin: \n\n ${err}`,
+    );
     process.exit(1);
   });
 
@@ -36,6 +40,9 @@ function init() {
           if (err) throw err;
         });
     console.dir(new Date() + ': ' + err["stack"]);
+    bot.telegram.sendMessage(
+        config.staffchat_id, `An error occured, please report this to your admin: \n\n ${err}`,
+    );
   });
 }
 

src/index.ts

@@ -11,12 +11,13 @@ import * as files from './files';
 import config from '../config/config';
 import * as error from './error';
 
-// Init error handling
-error.init();
 
 // Create new Telegraf() with token
 const bot = new Telegraf(config.bot_token);
 
+// Init error handling
+error.init(bot);
+
 // TODO: Unit testing
 const testing = false;
 if (testing) {
@@ -88,6 +89,9 @@ bot.hears('testing', (ctx) => text.handleText(bot, ctx, keys));
 bot.hears(/(.+)/, (ctx) => text.handleText(bot, ctx, keys));
 
 // Catch bot errors
-bot.catch((err) => console.log('Error: ', err));
+bot.catch((err, ctx) => {
+  console.log('Error: ', err);
+  ctx.reply('Message is not sent due to an error.');
+});
 
 bot.launch();

src/middleware.ts

@@ -22,8 +22,17 @@ const downloadDocumentMiddleware = (bot, ctx, next) => {
   });
 };
 
+// escape special characters
+const escapeText = (str) => {
+  return str.replace(/&/g, '&')
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;')
+            .replace(/"/g, '&quot;');
+}
+
 export {
   downloadPhotoMiddleware,
   downloadVideoMiddleware,
   downloadDocumentMiddleware,
+  escapeText,
 };

src/staff.ts

@@ -1,6 +1,7 @@
 import config from '../config/config';
 import cache from './cache';
 const {Extra} = require('telegraf');
+import * as middleware from './middleware';
 import * as db from './db';
 
 /** Message template helper
@@ -12,7 +13,7 @@ import * as db from './db';
 function ticketMsg(name, message) {
   return `${config.language.dear} <b>`+
     `${name}</b>,\n\n`+
-    `${message.text}\n\n`+
+    `${middleware.escapeText(message.text)}\n\n`+
     `${config.language.regards}\n`+
     `${message.from.first_name}`;
 }

src/users.ts

@@ -1,6 +1,7 @@
 import * as db from './db';
 import cache from './cache';
 import config from '../config/config';
+import * as middleware from './middleware';
 const {Extra} = require('telegraf');
 
 /** Message template helper
@@ -19,7 +20,7 @@ function ticketMsg(ticket, message, anon = true) {
           `<a href="${link}">` +
           `${message.from.first_name}</a> ${config.language.language}: ` +
           `${message.from.language_code}\n\n` +
-          `${message.text}`;
+          `${middleware.escapeText(message.text)}`;
 }
 
 /**