Skip to content

fix(callback): add null guards and try-catch wrapper to callback query handler (issue #20) - #38

Merged
labtgbot merged 1 commit into
mainfrom
issue-20-callback-query-safety
Jun 15, 2026
Merged

fix(callback): add null guards and try-catch wrapper to callback query handler (issue #20)#38
labtgbot merged 1 commit into
mainfrom
issue-20-callback-query-safety

Conversation

@xdevrobot

Copy link
Copy Markdown
Collaborator

Summary

Fixes MEDIUM — Runtime Crash / Type Confusion in the callback query handler. Unsafe type assertions on Telegram update objects could cause TypeError crashes when GramJS returns an unexpected shape. Any unhandled error would kill the callback query handler for all future queries.

Root Cause

The handler at src/index.ts:1237 had five unsafe patterns:

  1. queryId passed directly to answerCallbackQuery() without null-check
  2. data?.toString() — if data exists but lacks toString(), it crashes
  3. Number(undefined)NaN for msgId (silent)
  4. Number(undefined)NaN for userId (silent)
  5. No try-catch — any error kills the handler permanently

Changes

src/index.ts — callback query handler

  • Early return on missing queryId: If queryId is null/undefined, skip processing (can't answer without it)
  • Early return on missing data: If data is empty or not parseable, skip dispatch
  • Safe toString() check: typeof callbackUpdate.data?.toString === "function" instead of assuming the method exists
  • Number.isFinite guards: messageId and userId default to 0 instead of NaN
  • Outer try-catch: Wraps the entire handler body — malformed updates are logged but never kill the handler

Robustness Improvements

Issue Before After
Missing queryId Passed to GramJS (crash) Early return
data without toString() TypeError crash typeof guard → empty string → early return
msgId: undefined NaN 0 (via Number.isFinite)
userId: undefined NaN 0 (via Number.isFinite)
Any unhandled error Handler dies permanently Caught, logged, handler survives

Closes #20

🤖 Generated with Claude Code

…y handler (issue #20)

Prevents runtime crashes from unexpected Telegram update shapes:
- Early return if queryId is missing (can't answer without it)
- Early return if data is missing/empty (nothing to dispatch)
- Safe toString() check via typeof guard
- Number.isFinite guards on msgId/userId to prevent NaN propagation
- Outer try-catch prevents handler death from any malformed update
@labtgbot
labtgbot merged commit 61343dc into main Jun 15, 2026
17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[MEDIUM] Callback query handler uses unsafe type assertions that can crash on unexpected Telegram update shapes

2 participants