Support InputFile deserialization

Author: wiz0u

src/Telegram.Bot/Extensions/FormatExtensions.cs

@@ -61,7 +61,7 @@ public static string ToMarkdown(string message, MessageEntity[]? entities)
                         else if (nextEntity.Type is MessageEntityType.DateTime)
                         {
                             closing.md = string.IsNullOrEmpty(nextEntity.DateTimeFormat) ? "" : $"&format={nextEntity.DateTimeFormat}";
-                            closing.md = $"](tg://time?unix={((DateTimeOffset)nextEntity.UnixTime!).ToUnixTimeSeconds()}{closing.md})";
+                            closing.md = $"](tg://time?unix={((DateTimeOffset)nextEntity.UnixTime!.Value).ToUnixTimeSeconds()}{closing.md})";
                         }
                     }
                     else if (md[0] == '>')
@@ -184,7 +184,7 @@ public static string ToHtml(string message, MessageEntity[]? entities)
                     else if (nextEntity.Type is MessageEntityType.DateTime)
                     {
                         tag = string.IsNullOrEmpty(nextEntity.DateTimeFormat) ? null : $" format=\"{nextEntity.DateTimeFormat}\"";
-                        tag = $"<tg-time unix=\"{((DateTimeOffset)nextEntity.UnixTime!).ToUnixTimeSeconds()}\"{tag}>";
+                        tag = $"<tg-time unix=\"{((DateTimeOffset)nextEntity.UnixTime!.Value).ToUnixTimeSeconds()}\"{tag}>";
                     }
                     else
                         tag = $"<{tag}>";
@@ -640,7 +640,7 @@ private static ReplyMarkup ParseHtmlKeyboard(ReadOnlySpan<char> keyboard)
                 while (true)
                 {
                     if (CheckHtmlArg(ref keyboard, "style=\"", out var style))
-                        button.Style = Enum.Parse<KeyboardButtonStyle>(style, true);
+                        button.Style = Enum.Parse<KeyboardButtonStyle>(style, ignoreCase: true);
                     else if (CheckHtmlArg(ref keyboard, "icon=\"", out var emojiId))
                         button.IconCustomEmojiId = emojiId;
                     else

src/Telegram.Bot/PassportDecrypter.cs

@@ -3,7 +3,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 
-#pragma warning disable CA2208, MA0015
+#pragma warning disable CA2208, MA0015, MA0076
 #pragma warning disable CA1850, CA1835
 
 namespace Telegram.Bot.Types.Passport

src/Telegram.Bot/Serialization/InputFileConverter.cs

@@ -1,10 +1,14 @@
 using System.Threading;
+using Telegram.Bot.Exceptions;
+
+#pragma warning disable CS1591
 
 namespace Telegram.Bot.Serialization;
 
-internal sealed class InputFileConverter : JsonConverter<InputFile?>
+public sealed class InputFileConverter : JsonConverter<InputFile?>
 {
-    internal static readonly AsyncLocal<List<InputFileStream>?> Attachments = new();
+    public static string? AllowLocalFilesUnder { get; set; } // if not empty, should end with a path separator
+    public static readonly AsyncLocal<List<InputFileStream>?> Attachments = new();
 
     public override bool CanConvert(Type typeToConvert) => typeof(InputFile).IsAssignableFrom(typeToConvert);
 
@@ -18,7 +22,17 @@ internal sealed class InputFileConverter : JsonConverter<InputFile?>
         if (value is null)
             return null;
         if (value.StartsWith("attach://", StringComparison.OrdinalIgnoreCase))
-            return new InputFileStream(Stream.Null, value[9..]);
+            if (Attachments.Value?.Find(a => a.FileName?.StartsWith(value, StringComparison.Ordinal) == true) is { } ifs)
+                return new InputFileStream(ifs.Content, ifs.FileName![(value.Length + 1)..]);
+            else
+                return new InputFileStream(Stream.Null, value[9..]);
+        else if (value.StartsWith("file://", StringComparison.OrdinalIgnoreCase))
+            if (AllowLocalFilesUnder == null)
+                throw new ApiRequestException("file:// URI not allowed", 400);
+            else if (Path.GetFullPath(new Uri(value).LocalPath) is { } path && path.StartsWith(AllowLocalFilesUnder, StringComparison.OrdinalIgnoreCase))
+                return new InputFileStream(File.OpenRead(path), Path.GetFileName(path));
+            else
+                throw new ApiRequestException("file:// path is not under allowed folder", 400);
 
         return Uri.TryCreate(value, UriKind.Absolute, out var url)
             ? new InputFileUrl(url)

src/Telegram.Bot/Telegram.Bot.csproj

@@ -58,7 +58,7 @@ $(ReleaseNotes)</Description>
     <NoWarn>$(NoWarn);CA1510</NoWarn> <!-- Use 'ArgumentNullException.ThrowIfNull' instead of explicitly throwing
                                            a new exception instance -->
     <NoWarn>$(NoWarn);MA0046</NoWarn> <!-- The delegate must return void -->
-    <NoWarn>$(NoWarn);MA0001;MA0048;MA0051;MA0111;MA0113</NoWarn>
+    <NoWarn>$(NoWarn);MA0001;MA0042;MA0048;MA0051;MA0111;MA0113</NoWarn>
     <NoWarn>$(NoWarn);IDE0079;IDE0130</NoWarn>
     <NoWarn>$(NoWarn);CS0419</NoWarn> <!-- Ambiguous reference in cref attribute -->
     <NoWarn>$(NoWarn);IL2026</NoWarn> <!-- Using member 'method' which has 'RequiresUnreferencedCodeAttribute'... it's ok we use JsonSerializerOptions with type resolver context -->