Actualizacion de seguridad

node_modules/telegraf/core/network/client.js

@@ -8,18 +8,12 @@ const TelegramError = require('./error')
 const MultipartStream = require('./multipart-stream')
 const { isStream } = MultipartStream
 
-const WEBHOOK_BLACKLIST = [
-  'getChat',
-  'getChatAdministrators',
-  'getChatMember',
-  'getChatMembersCount',
-  'getFile',
-  'getFileLink',
-  'getGameHighScores',
-  'getMe',
-  'getUserProfilePhotos',
-  'getWebhookInfo',
-  'exportChatInviteLink'
+const WEBHOOK_ALLOWLIST = [
+  'answerCallbackQuery',
+  'answerInlineQuery',
+  'deleteMessage',
+  'leaveChat',
+  'sendChatAction'
 ]
 
 const DEFAULT_EXTENSIONS = {
@@ -34,7 +28,7 @@ const DEFAULT_EXTENSIONS = {
 
 const DEFAULT_OPTIONS = {
   apiRoot: 'https://api.telegram.org',
-  webhookReply: true,
+  webhookReply: false,
   agent: new https.Agent({
     keepAlive: true,
     keepAliveMsecs: 10000
@@ -247,7 +241,7 @@ class ApiClient {
       .filter((key) => typeof data[key] !== 'undefined' && data[key] !== null)
       .reduce((acc, key) => ({ ...acc, [key]: data[key] }), {})
 
-    if (options.webhookReply && response && !responseEnd && !WEBHOOK_BLACKLIST.includes(method)) {
+    if (options.webhookReply && response && !responseEnd && WEBHOOK_ALLOWLIST.includes(method)) {
       debug('Call via webhook', method, payload)
       this.responseEnd = true
       return answerToWebhook(response, { method, ...payload }, options)