security: validate Telegram fallback URLs to prevent token leak

- Add validateFallbackURL helper in internal/telegram/network.go.
- Allow only HTTPS telegram.org hosts or loopback addresses.
- Change NewFallbackTransport and Bot.SetFallbackURLs to return errors.
- Update cmd/odek/telegram.go caller to fail closed on invalid fallbacks.
- Update network/bot tests and add validation coverage.
- Document allowed fallback URL schemes in docs/TELEGRAM.md.
- Remove resolved sec_findings.md entry.

Full suite: go test ./... -count=1 passes.

Author: jkyberneees

cmd/odek/telegram.go

@@ -187,7 +187,9 @@ func telegramCmd(args []string) error {
 
 	// 4c. Configure fallback Telegram API endpoints if provided.
 	if len(cfg.FallbackURLs) > 0 {
-		bot.SetFallbackURLs(cfg.FallbackURLs)
+		if err := bot.SetFallbackURLs(cfg.FallbackURLs); err != nil {
+			return fmt.Errorf("telegram: invalid fallback URL: %w", err)
+		}
 	}
 
 	// 4d. Configure daily token budget (0 = unlimited, the default).

docs/TELEGRAM.md

@@ -83,7 +83,14 @@ See [Error Handling & Retry](#error-handling--retry) above for retry strategy, `
 
 ### Fallback URLs
 
-`SetFallbackURLs` configures alternate Telegram API endpoints. If the primary endpoint is unreachable, the bot falls through to the next URL in the list. This is useful for regions where `api.telegram.org` may be blocked.
+`SetFallbackURLs` configures alternate Telegram API endpoints. If the primary endpoint is unreachable, the bot falls through to the next URL in the list. This is useful for regions where `api.telegram.org` may be blocked or for pointing at a local [Telegram Bot API server](https://core.telegram.org/bots/api#using-a-local-bot-api-server).
+
+Fallback URLs are validated on startup. Only the following are accepted:
+
+- HTTPS hosts under `telegram.org` (e.g. `https://api.telegram.org`, `https://fallback.api.telegram.org`).
+- Loopback addresses for local Bot API servers (e.g. `http://127.0.0.1:8081`, `http://localhost:8081`, `http://[::1]:8081`).
+
+Non-HTTPS, non-loopback, or non-Telegram URLs are rejected to prevent the bot token from leaking to third parties, because the fallback transport rewrites the request host while preserving the original path (`/bot<token>/<method>`).
 
 ### Daily Token Budget
 

internal/telegram/bot.go

@@ -651,12 +651,20 @@ func (b *Bot) SetMyCommands(commands []BotCommand) error {
 // "https://api.telegram.org" (without the /bot<token> suffix). The fallback
 // transport rewrites the host on each request, keeping the original path
 // (which includes the token).
-func (b *Bot) SetFallbackURLs(urls []string) {
+//
+// Fallback URLs are validated: they must be HTTPS telegram.org hosts or
+// loopback addresses. This prevents the bot token from leaking to arbitrary
+// third-party endpoints.
+func (b *Bot) SetFallbackURLs(urls []string) error {
 	if len(urls) == 0 {
-		return
+		return nil
+	}
+	ft, err := NewFallbackTransport(urls)
+	if err != nil {
+		return err
 	}
-	ft := NewFallbackTransport(urls)
 	ft.WrapBot(b)
+	return nil
 }
 
 // SetDailyTokenBudget sets the daily token usage budget for the bot.

internal/telegram/bot_test.go

@@ -1149,8 +1149,10 @@ func TestBot_SetFallbackURLs(t *testing.T) {
 	bot := NewBot("testtoken")
 	originalClient := bot.Client
 
-	fallbacks := []string{"https://api.telegram2.org", "https://api.telegram3.org"}
-	bot.SetFallbackURLs(fallbacks)
+	fallbacks := []string{"https://fallback1.api.telegram.org", "https://fallback2.api.telegram.org"}
+	if err := bot.SetFallbackURLs(fallbacks); err != nil {
+		t.Fatalf("SetFallbackURLs: %v", err)
+	}
 
 	// The bot's client should have been replaced.
 	if bot.Client == originalClient {
@@ -1166,11 +1168,11 @@ func TestBot_SetFallbackURLs(t *testing.T) {
 	if len(ft.FallbackURLs) != 2 {
 		t.Errorf("FallbackURLs length = %d, want 2", len(ft.FallbackURLs))
 	}
-	if ft.FallbackURLs[0] != "https://api.telegram2.org" {
-		t.Errorf("FallbackURLs[0] = %q, want %q", ft.FallbackURLs[0], "https://api.telegram2.org")
+	if ft.FallbackURLs[0] != "https://fallback1.api.telegram.org" {
+		t.Errorf("FallbackURLs[0] = %q, want %q", ft.FallbackURLs[0], "https://fallback1.api.telegram.org")
 	}
-	if ft.FallbackURLs[1] != "https://api.telegram3.org" {
-		t.Errorf("FallbackURLs[1] = %q, want %q", ft.FallbackURLs[1], "https://api.telegram3.org")
+	if ft.FallbackURLs[1] != "https://fallback2.api.telegram.org" {
+		t.Errorf("FallbackURLs[1] = %q, want %q", ft.FallbackURLs[1], "https://fallback2.api.telegram.org")
 	}
 }
 
@@ -1179,13 +1181,29 @@ func TestBot_SetFallbackURLs_Empty(t *testing.T) {
 	originalClient := bot.Client
 
 	// Empty slice should be a no-op.
-	bot.SetFallbackURLs([]string{})
+	if err := bot.SetFallbackURLs([]string{}); err != nil {
+		t.Fatalf("SetFallbackURLs(empty): %v", err)
+	}
 
 	if bot.Client != originalClient {
 		t.Error("bot.Client was replaced despite empty fallback list")
 	}
 }
 
+func TestBot_SetFallbackURLs_InvalidRejected(t *testing.T) {
+	bot := NewBot("testtoken")
+	originalClient := bot.Client
+
+	if err := bot.SetFallbackURLs([]string{"https://attacker.example.com"}); err == nil {
+		t.Fatal("expected error for untrusted fallback URL, got nil")
+	}
+
+	// Client must not be replaced when validation fails.
+	if bot.Client != originalClient {
+		t.Error("bot.Client was replaced despite invalid fallback URL")
+	}
+}
+
 // ---------------------------------------------------------------------------
 // SetDailyTokenBudget / CheckDailyBudget
 // ---------------------------------------------------------------------------

internal/telegram/network.go

@@ -2,8 +2,10 @@ package telegram
 
 import (
 	"fmt"
+	"net"
 	"net/http"
 	"net/url"
+	"strings"
 	"time"
 )
 
@@ -16,10 +18,59 @@ type FallbackTransport struct {
 	Client       *http.Client
 }
 
+// validateFallbackURL checks that a fallback URL is a trusted Telegram API
+// endpoint. The bot token is embedded in the request path, so untrusted
+// fallbacks would leak the secret to third parties.
+//
+// Allowed:
+//   - https:// hosts under telegram.org (e.g. api.telegram.org)
+//   - http or https on loopback addresses (localhost, 127.0.0.1, ::1)
+func validateFallbackURL(raw string) error {
+	u, err := url.Parse(raw)
+	if err != nil {
+		return fmt.Errorf("invalid URL: %w", err)
+	}
+	if u.Scheme == "" || u.Host == "" {
+		return fmt.Errorf("URL must have a scheme and host")
+	}
+
+	host := u.Hostname()
+	if host == "" {
+		return fmt.Errorf("URL must have a host")
+	}
+
+	// Loopback is trusted for local Bot API servers.
+	ip := net.ParseIP(host)
+	if ip != nil && ip.IsLoopback() {
+		return nil
+	}
+	if strings.EqualFold(host, "localhost") {
+		return nil
+	}
+
+	// Everything else must be HTTPS and Telegram-controlled.
+	if !strings.EqualFold(u.Scheme, "https") {
+		return fmt.Errorf("non-loopback fallback URL must use HTTPS")
+	}
+	if !strings.EqualFold(host, "api.telegram.org") && !strings.HasSuffix(strings.ToLower(host), ".telegram.org") {
+		return fmt.Errorf("fallback URL must be a telegram.org host or loopback")
+	}
+	return nil
+}
+
 // NewFallbackTransport creates a FallbackTransport with the given fallback
 // URLs. The primary URL defaults to https://api.telegram.org and the timeout
 // defaults to 30 seconds.
-func NewFallbackTransport(fallbackURLs []string) *FallbackTransport {
+//
+// It returns an error if any fallback URL is untrusted, because the bot token
+// is sent in the request path and untrusted endpoints would receive it.
+func NewFallbackTransport(fallbackURLs []string) (*FallbackTransport, error) {
+	for _, raw := range fallbackURLs {
+		if err := validateFallbackURL(raw); err != nil {
+			return nil, fmt.Errorf("invalid fallback URL %q: %w", raw, err)
+		}
+	}
+
 	ft := &FallbackTransport{
 		PrimaryURL:   "https://api.telegram.org",
 		FallbackURLs: fallbackURLs,
@@ -29,7 +80,7 @@ func NewFallbackTransport(fallbackURLs []string) *FallbackTransport {
 		Timeout:   ft.Timeout,
 		Transport: ft,
 	}
-	return ft
+	return ft, nil
 }
 
 // allURLs returns the primary URL followed by all fallback URLs in a single