We can create bots in @BotFather. And we can create web apps that are linked to bots. If we want to edit all-related info of the web app, we use /myapps command for selecting the web app, and inline keyboards for editing inner info (e.g. URL, picture, description). If we delete the web app and continue to use old message inline keyboards, editing and seeing info of the web app works. It’s totally not accessible outside (we can’t open it using a short url or see in the list of /myapps), but it’s 100% editable and seeable, if we use old messages carefully. That seems some unlogic
Steps to reproduce:
[1] Open Telegram client and go to @BotFather (skip to [3] if you’ve already got some bots for testing)
[2] Create a new bot using @BotFather
[3] Create a new web app that linked to the just now created bot
[4] Send /myapps command
[5] Select the just now created web app. We’ll see text messages with inline keyboards for editing and seeing the web app’s info. Keep these messages not touched and undeleted!
[6] Send /myapps command again
[7] Select that web app again and delete the web apps using inline keyboards, It shows “The web app successfully deleted”. We’ll no longer see the web bot using /myapps list no longer.
[8] Click [5] old message’s inline keyboards for editing info etc. It’s working! The deleted web app is now resurrected.
Impact:
That causes some misunderstanding for bot creators, if he mistakenly use old messages and potentially make problems in delivering production-ready web apps for users. It seems Telegram doesn’t actually delete the bot creators’ deleted web apps, instead it saves such web apps in its backend and simply adds the “deleted: true” property to web apps’ object. In /myapps list, maybe the backend filtering for not showing web apps with “deleted: true” property, but anyway it’s accessible through old messages. If the Telegram backend really saves deleted web apps to their backend, accessing such web apps with old message keyboards is kind of a security problem by revealing Telegram’s inner private data to users. Even if it doesn't, such unlogic situation causes misunderstanding in bot creators. Telegram’s latest focus is targeted on more web apps after web bots like Notcoin, Hamster Combat. With the popularization of web bots, someday eventually, problems with this situation will occur. So it’s much better to fix it earlier.
Misunderstanding for bot creators: Developers might mistakenly modify deleted web apps, leading to unintended consequences or errors in production environments.
Potential security concern: If Telegram stores deleted web apps in its backend and only marks them as "deleted: true," this could expose private data to users through these old messages.
Usability issue: The inconsistency between the web app being deleted and still accessible creates confusion and a poor user experience.
Additional details:
Only used @BotFather in Telegram (any application). Media proof (it’s better to see what’s talk is actually about if I can’t describe the problem well in text-written format)