The chat-telegram target currently builds its manifest artifact path by interpolating raw config.botUsername into a path string:
return { artifact: `${ctx.outDir}/telegram-${config.botUsername}.json` };A username containing path separators, for example ../demo_bot, makes the returned artifact path escape or traverse relative to ctx.outDir:
<outDir>/telegram-../demo_bot.json
The artifact filename should sanitize the bot username for local filesystem use while preserving the original username for Telegram API calls and public bot URLs.
The
chat-telegramtarget currently builds its manifest artifact path by interpolating rawconfig.botUsernameinto a path string:A username containing path separators, for example
../demo_bot, makes the returned artifact path escape or traverse relative toctx.outDir:The artifact filename should sanitize the bot username for local filesystem use while preserving the original username for Telegram API calls and public bot URLs.