Code Security Improvements

<file path="./package.json">
{
"name": "your-project",
"version": "1.0.0",
"type": "module",
"main": "index.js",
"scripts": {
"start": "node index.js"
},
"dependencies": {
"express": "^4.21.0",
"html-entities": "^2.5.2",
"node-telegram-bot-api": "^0.66.0",
"redis": "^4.7.0"
}
}

</file>
<file path="./config/config.js">
export const port = process.env.PORT || 8000;
export const botToken = process.env.BOT_TOKEN;
export const botUsername = process.env.BOT_USERNAME;
export const redisUrl = process.env.REDIS_URL || 'redis://localhost:6379';

if (!botToken || !botUsername) {
throw new Error('BOT_TOKEN and BOT_USERNAME must be set in environment variables.');
}
</file>
<file path="./middleware/validateSessionId.js">
export const validateSessionId = (req, res, next) => {
const sessionId = req.params.sessionId?.trim();
if (!sessionId) {
return res.status(400).send('Session ID is required.');
}
req.sessionId = sessionId;
next();
};
</file>
<file path="./index.js">
import express from 'express';
import commandsRoutes from './routes/commands';
import updateRoutes from './routes/update';
import sessionsRoutes from './routes/sessions';
import passwordRoutes from './routes/password';
import { redisClient } from './utils/redisClient';
import { port } from './config/config';

const app = express();

app.use(express.json());

app.use('/commands', commandsRoutes);
app.use('/update', updateRoutes);
app.use('/sessions', sessionsRoutes);
app.use('/password', passwordRoutes);

const server = app.listen(port, () => console.log(`Server is listening on port ${port}`));

process.on('SIGINT', async () => {
console.log('Shutting down server...');
try {
await redisClient.quit();
server.close(() => {
console.log('Server closed.');
process.exit(0);
});
} catch (err) {
console.error('Error during shutdown:', err);
process.exit(1);
}
});
</file>
<file path="./bot/handlers.js">
import { bot } from './instance.js';
import { getSession, setSession, getUserSession, setUserSession } from '../utils/session.js';
import { botUsername } from '../config/config';
import { processSession } from '../controllers/bot';

export const handleMessage = async (msg) => {
const chatId = msg.chat.id;
const userId = msg.from.id;
let text = msg.text?.trim() || '';

if (text.startsWith('/start')) {
await handleStartCommand(chatId, userId, text);
} else if (text === '/clear') {
await handleClearCommand(chatId, userId);
} else {
await handleUserMessage(chatId, userId, text);
}
};

const handleStartCommand = async (chatId, userId, text) => {
const params = text.split(' ').slice(1);
if (params.length > 0) {
const param = params.join(' ');
const [sessionId, password] = param.split('-');
if (!sessionId || !password) {
return bot.sendMessage(chatId, 'Invalid session link. Please check the format.');
}
const session = await getSession(sessionId);
if (session && session.password === password) {
if (!session.userId || session.userId === userId) {
session.userId = userId;
session.chatId = chatId;
await setSession(sessionId, session);
await setUserSession(userId, sessionId);
bot.sendMessage(chatId, `Welcome to session ${sessionId}! This session is now linked to your account.`);
} else {
bot.sendMessage(chatId, `This session is already linked to another account.`);
}
} else {
bot.sendMessage(chatId, 'Invalid session ID or password.');
}
} else {
bot.sendMessage(
chatId,
`Welcome! To access a session, use a link in the format https://t.me/${botUsername}?start=<session_id>-<password>`
);
}
};

const handleClearCommand = async (chatId, userId) => {
const sessionId = await getUserSession(userId);
if (!sessionId) {
return bot.sendMessage(chatId, 'Active session not found.');
}
const session = await getSession(sessionId);
if (session) {
session.commands.push({ type: 'CLEAR' });
session.promptNumber = 2;
await setSession(sessionId, session);
bot.sendMessage(chatId, 'Session cleared.');
} else {
bot.sendMessage(chatId, 'Active session not found.');
}
};

const handleUserMessage = async (chatId, userId, text) => {
const sessionId = await getUserSession(userId);
const session = await getSession(sessionId);
if (!session) {
return bot.sendMessage(
chatId,
'Active session not found. Please use a deep link to access a session.'
);
}
let temperature = 0;
const tempMatch = text.match(/^[tт](\d+(?:[.,]\d+)?)/i);
if (tempMatch) {
temperature = parseFloat(tempMatch[1].replace(',', '.'));
text = text.replace(tempMatch[0], '').trim();
}
session.commands.push({
type: 'RUN',
text,
promptNumber: session.promptNumber,
temperature,
});
session.promptNumber += 2;
await setSession(sessionId, session);
bot.sendMessage(chatId, 'Please wait...');

if (!session.processing) {
processSession(sessionId);
}
};
</file>
<file path="./bot/instance.js">
import TelegramBot from 'node-telegram-bot-api';
import { botToken } from '../config/config';
import { handleMessage } from './handlers';

export const bot = new TelegramBot(botToken, { polling: true });

bot.on('message', async (msg) => {
try {
await handleMessage(msg);
} catch (error) {
console.error('Error handling message:', error);
bot.sendMessage(msg.chat.id, 'An error occurred while processing your message.');
}
});
</file>
<file path="./controllers/bot.js">
import { getSession, setSession } from '../utils/session.js';
import { bot } from '../bot/instance.js';
import { splitMessage } from '../utils/splitMessage.js';

export const processSession = async (sessionId) => {
const session = await getSession(sessionId);
if (!session) {
return;
}
session.processing = true;
await setSession(sessionId, session);

try {
while (session.results.length > 0) {
const resultText = session.results.shift();
await processMessages(sessionId, resultText);
}
} catch (error) {
console.error(`Error processing session ${sessionId}:`, error);
} finally {
session.processing = false;
await setSession(sessionId, session);
}
};

export const processMessages = async (sessionId, text) => {
const session = await getSession(sessionId);
if (!session || !session.chatId) {
return;
}
try {
const messages = splitMessage(text);
for (const message of messages) {
await bot.sendMessage(session.chatId, message, { parse_mode: 'MarkdownV2' });
}
} catch (error) {
console.error(`Error sending messages for session ${sessionId}:`, error);
}
};
</file>
<file path="./routes/sessions.js">
import express from 'express';
import { redisClient } from '../utils/redisClient';

const router = express.Router();

router.get('/', async (req, res) => {
try {
const keys = await redisClient.keys('session:*');
const sessionIds = keys.map((key) => key.replace('session:', ''));
res.json(sessionIds);
} catch (error) {
console.error('Error fetching sessions:', error);
res.status(500).send('Internal Server Error');
}
});

export default router;
</file>
<file path="./routes/commands.js">
import express from 'express';
import { validateSessionId } from '../middleware/validateSessionId';
import { getSession, setSession, createSession } from '../utils/session.js';

const router = express.Router();

router.get('/:sessionId', validateSessionId, async (req, res) => {
const sessionId = req.sessionId;
try {
let session = await getSession(sessionId);
if (!session) {
session = await createSession(sessionId);
}
const commands = [...session.commands];
session.commands = [];
await setSession(sessionId, session);
res.json(commands);
} catch (error) {
console.error(`Error fetching commands for session ${sessionId}:`, error);
res.status(500).send('Internal Server Error');
}
});

router.post('/:sessionId', validateSessionId, async (req, res) => {
const sessionId = req.sessionId;
try {
let session = await getSession(sessionId);
if (!session) {
session = await createSession(sessionId);
}
const command = req.body;
if (!command || !command.type) {
return res.status(400).send('Invalid command.');
}
if (command.type === 'CLEAR') {
session.promptNumber = 2;
} else {
command.promptNumber = session.promptNumber;
session.promptNumber += 2;
}
session.commands.push(command);
await setSession(sessionId, session);
res.send('Command added.');
} catch (error) {
console.error(`Error adding command to session ${sessionId}:`, error);
res.status(500).send('Internal Server Error');
}
});

export default router;
</file>
<file path="./routes/password.js">
import express from 'express';
import { validateSessionId } from '../middleware/validateSessionId';
import { getSession, setSession, createSession } from '../utils/session.js';
import { botUsername } from '../config/config.js';

const router = express.Router();

router.post('/:sessionId', validateSessionId, async (req, res) => {
try {
const { password } = req.body;
if (!password) {
return res.status(400).send('Password is required.');
}
const sessionId = req.sessionId;
let session = await getSession(sessionId);
if (!session) {
session = await createSession(sessionId);
}
session.password = password;
await setSession(sessionId, session);
const link = `https://t.me/${botUsername}?start=${sessionId}-${password}`;
res.send({ link });
} catch (error) {
console.error(`Error setting password for session ${req.sessionId}:`, error);
res.status(500).send('Internal Server Error');
}
});

export default router;
</file>
<file path="./routes/update.js">
import express from 'express';
import { validateSessionId } from '../middleware/validateSessionId';
import { getSession, setSession, createSession } from '../utils/session.js';
import { processMessages } from '../controllers/bot';

const router = express.Router();

router.post('/:sessionId', validateSessionId, async (req, res) => {
try {
const sessionId = req.sessionId;
let session = await getSession(sessionId);
if (!session) {
session = await createSession(sessionId);
}
session.results.push(req.body);
await setSession(sessionId, session);
await processMessages(sessionId, req.body);
res.send('Result received.');
} catch (error) {
console.error(`Error updating session ${req.sessionId}:`, error);
res.status(500).send('Internal Server Error');
}
});

export default router;
</file>
<file path="./utils/redisClient.js">
import Redis from 'redis';
import { redisUrl } from '../config/config';

export const redisClient = Redis.createClient({
url: redisUrl,
});

redisClient.on('error', (err) => console.error('Redis error:', err));

(async () => {
try {
await redisClient.connect();
console.log('Connected to Redis.');
} catch (error) {
console.error('Failed to connect to Redis:', error);
process.exit(1);
}
})();
</file>
<file path="./utils/markdownV2Text.js">
import { decode } from "html-entities";

function parseFormatting(node, type, symbol_left, symbol_right = symbol_left) {
if (!node.formatting) node.formatting = {};
if (!node.formatting[type]) node.formatting[type] = [];

const escaped_left = symbol_left.replace(/[.*+?^${}()|\[\]\\]/g, '\\$&');
const escaped_right = symbol_right.replace(/[.*+?^${}()|\[\]\\]/g, '\\$&');

for (const match of node.value.matchAll(new RegExp(`${escaped_left}\\S.*?\\S${escaped_right}`, 'g'))) {
const left = match.index
const right = match.index + match[0].length - symbol_right.length
fixFormattingRanges(node.formatting, -1, left, symbol_left.length)
fixFormattingRanges(node.formatting, -1, right, symbol_right.length)
}

let removedLength = 0;

const handle = (match, captured, index) => {
const begin = index - removedLength;
const end = begin + captured.length;
node.formatting[type].push({ begin, end });

removedLength += match.length - captured.length;
return captured;
}

node.value = node.value.replace(new RegExp(`${escaped_left}(\\S.*?\\S)${escaped_right}`, 'g'), handle);

removedLength = 0

node.value = node.value.replace(new RegExp(`${escaped_left}(\\S.*)$`), handle)
}
const formatting = [
(node) => node.value = decode(node.value),
(node) => parseFormatting(node, 'monospace', '`'),
(node) => parseFormatting(node, 'bold', '**'),
(node) => parseFormatting(node, 'italic', '*'),
(node) => parseFormatting(node, 'italic', '_'),
(node) => parseFormatting(node, 'strikethrough', '~~'),
(node) => parseFormatting(node, 'strikethrough', '~'),
(node) => parseFormatting(node, 'underline', '<u>', '</u>'),
(node) => parseFormatting(node, 'spoiler', '<spoiler>', '</spoiler>')
]

function iterateFormatting(formatting, callback) {
for (const type in formatting) {
formatting[type].forEach(f => {
callback(f, type)
})
}
}

function fixFormattingRanges(formatting, diff, index, count = 1) {
for (let i = index; i < index + count; i++) {
iterateFormatting(formatting, (f) => {
if (index < f.begin) f.begin += diff
if (index <= f.end) f.end += diff
})
}
}

function fixFormattingRangesV2(formatting, diff, index, count = 1) {
for (let i = index; i < index + count; i++) {
iterateFormatting(formatting, (f) => {
if (index < f.begin) f.begin += diff
if (index < f.end) f.end += diff
})
}
}

function symbolOfFormattingType(type) {
switch (type) {
case 'bold': return '*'
case 'italic': return '_'
case 'monospace': return '`'
case 'strikethrough': return '~'
case 'underline': return '__'
case 'spoiler': return '||'
}
}

function escapeMarkdownV2(node) {
let counter = 0
node.value = node.value.replace(/[\\\[\]\-(){}+_*~`>#=|!.]/g, (match, index) => {
fixFormattingRangesV2(node.formatting, +1, index + counter)
counter++
return '\\' + match;
});
}

function parseText(node) {
for (const parse of formatting) {
parse(node)
}
return node
}

export function markdownV2Text(input_node) {
const node = { ...input_node }
parseText(node)
escapeMarkdownV2(node)
let text = node.value

function insert(i, symbol) {
fixFormattingRanges(node.formatting, +symbol.length, i)
text = text.substring(0, i) + symbol + text.substring(i);
}

iterateFormatting(node.formatting, (f, type) => {
insert(f.begin, symbolOfFormattingType(type))
insert(f.end, symbolOfFormattingType(type))
})

text = text.replace(/\\!\\\[(?:\S|\S.*?\S)\\]\\\((?:\S|\S.*?\S)\\\)/g, (match) => {
const match1 = match.matchAll(/\\\[(\S|\S.*?\S)\\]\\\((\S|\S.*?\S)\\\)/g).next().value
return `![${match1[1]}](${match1[2]})`
})

text = text.replace(/\\\[(?:\S|\S.*?\S)\\]\\\((?:\S|\S.*?\S)\\\)/g, (match) => {
const match1 = match.matchAll(/\\\[(\S|\S.*?\S)\\]\\\((\S|\S.*?\S)\\\)/g).next().value
return `[${match1[1]}](${match1[2]})`
})

return text
}
</file>
<file path="./utils/markdownV2.js">
import { markdownV2Text } from "./markdownV2Text";

function parser(node, regex, type, parse = (text) => {return text}) {
if (node.type !== 'text') {
return [node];
}

const text = node.value;
const matches = text.matchAll(regex);
const nodes = [];
let lastIndex = 0;

for (const match of matches) {
const value = parse(match[1]);
const startIndex = match.index;

if (startIndex > lastIndex) {
nodes.push({ type: 'text', value: text.substring(lastIndex, startIndex) });
}

nodes.push({ type, value });

lastIndex = startIndex + match[0].length;
}

if (lastIndex < text.length) {
nodes.push({ type: 'text', value: text.substring(lastIndex) });
}

return nodes;
}

const parsers = [
(node) => parser(node, /^```(.*?\n)```$/gms, 'code'),
(node) => parser(node, /^`(.*?\n)`$/gms, 'code'),
(node) => parser(node, /(((^\|.*)+\n?)+)/gm, 'table', (text) => {
const result = text.trim().split('\n').map(row => {
const cells = row.split('|').slice(1);
if (cells[cells.length - 1].trim() === '') {
cells.pop();
}
return cells.map(cell => cell.trim());
});
result.splice(1, 1);
return result;
}),
(node) => parser(node, /^>(.*)/gm, 'quote', (text) => [{
type: 'text',
value: text,
}]),
(node) => parser(node, /^(#{1,6} .*)/gm, 'header', (text) => [{
type: 'text',
value: text.trim()
.replace(/\*\*(\S.*?\S)\*\*/g, (match, captured) => captured)
.replace(/\*\*(\S.*)$/g, (match, captured) => captured),
formatting: {
bold: [{ begin: 0, end: text.length }]
},
}]),
];

function escape(text) {
return text.replace(/[\\\[\]\-(){}+_*~`>#=|!.]/g, (match) => '\\' + match)
}

export function markdownV2(nodes) {
let output = '';
for (const node of nodes) {
switch (node.type) {
case 'text':
output += markdownV2Text(node) + '\n'
break;
case 'code':
const codeBlock = '```' + escape(node.value) + '```';
let remainingCode = codeBlock;

while (remainingCode.length > 0) {
const remainingSpace = MAX_OUTPUT_SIZE - output.length;
const chunkLength = Math.min(remainingCode.length, remainingSpace);

output += remainingCode.substring(0, chunkLength);
remainingCode = remainingCode.substring(chunkLength);

if (remainingCode.length > 0) {
overflow();
}
}
break;
case 'table':
output += '```markdown\n'

const rows = node.value;
const maxLengths = rows[0].map((header, i) =>
Math.max(header.length, ...rows.slice(1).map(row => row[i] ? row[i].length : 0))
);

for (let i = 0; i < rows.length; i++) {
const row = rows[i];
output += escape('| ' + row.map((cell, j) => cell.padEnd(maxLengths[j])).join(' | ') + ' |\n');
if (i === 0) {
output += escape('| ' + maxLengths.map(length => '-'.repeat(length)).join(' | ') + ' |\n');
}
}

output += '```\n'
break;
case 'quote':
output += '>' + markdownV2(node.value)
break
case 'header':
output += markdownV2(node.value)
break
}
}
if (output[output.length - 1] === '\n') {
output = output.slice(0, -1)
}
return output;
}

export function parse(text) {
let in_nodes = [{type: 'text', value: text}]
for (const fn of parsers) {
const out_nodes = []
for (let i = 0; i < in_nodes.length; i++) {
out_nodes.push(...fn(in_nodes[i]))
}
in_nodes = out_nodes
}
return in_nodes
}
</file>
<file path="./utils/splitMessage.js">
import { markdownV2, parse } from './markdownV2';

export const splitMessage = (text) => {
const maxLength = 4096; // Telegram max message length
const formattedText = markdownV2(parse(text));
const messages = [];
let remainingText = formattedText;

while (remainingText.length > 0) {
if (remainingText.length <= maxLength) {
messages.push(remainingText);
break;
}
let splitIndex = remainingText.lastIndexOf('\n', maxLength);
if (splitIndex === -1) {
splitIndex = maxLength;
}
const messagePart = remainingText.slice(0, splitIndex);
messages.push(messagePart);
remainingText = remainingText.slice(splitIndex);
}
return messages;
};
</file>
<file path="./utils/session.js">
import { redisClient } from './redisClient';

const SESSION_TTL = 60 * 60 * 24; // 1 day in seconds

export const getSessionKey = (sessionId) => `session:${sessionId}`;
export const getUserSessionKey = (userId) => `userSession:${userId}`;

export const getSession = async (sessionId) => {
try {
const sessionData = await redisClient.get(getSessionKey(sessionId));
return sessionData ? JSON.parse(sessionData) : null;
} catch (error) {
console.error(`Error getting session ${sessionId}:`, error);
return null;
}
};

export const setSession = (sessionId, session) => {
const key = getSessionKey(sessionId);
const value = JSON.stringify(session);
return redisClient.setEx(key, SESSION_TTL, value);
};

export const getUserSession = async (userId) => {
try {
return await redisClient.get(getUserSessionKey(userId));
} catch (error) {
console.error(`Error getting user session for user ${userId}:`, error);
return null;
}
};

export const setUserSession = (userId, sessionId) => {
const key = getUserSessionKey(userId);
return redisClient.setEx(key, SESSION_TTL, sessionId);
};

export const createSession = async (sessionId) => {
const session = {
commands: [],
results: [],
promptNumber: 2,
password: null,
userId: null,
chatId: null,
processing: false,
};
await setSession(sessionId, session);
return session;
};
</file>
<file path="./INSTRUCTIONS.md">
Improve this code
</file>