5 releases 9 tags

RSS feed

• 1.5.6 8f8567a97c

  Compare

  1.5.6 Stable

  eric released this 2026-07-02 10:04:47 -07:00 | 1 commits to main since this release

  v1.5.6 - Security hardening

  Fixes from the 5th security audit. Malformed/attacker input that used to trigger HTTP 500 now returns a proper 4xx. No auth bypass existed — all crash paths already failed closed. Drop-in upgrade, no config changes.

  • Non-ASCII Authorization / X-*-Signature headers → 403 (was 500)
  • Deeply-nested JSON → 400 (was 500)
  • Non-object / type-confused JSON payloads → 400 (was 500), across all 24 formatters
  • Log injection hardened: control chars in X-*-Delivery, event-type, and Apprise response bodies are escaped before logging
  • 10 regression tests added; suite 140 passing

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 1.5.5 8f8567a97c

  Compare

  1.5.5 Stable

  eric released this 2026-07-01 22:45:56 -07:00 | 1 commits to main since this release

  v1.5.5

  Security (run-4 audit fixes)

  • HTML injection via branch/ref names in titles — push, create, and delete events interpolated the git branch/ref into the notification title unescaped. Git refs permit <, >, and /, so a crafted branch name (e.g. <a/href="evil/x">click</a>) rendered as a live anchor in Telegram HTML. Now escaped. Corrects v1.5.4's incorrect "refs non-exploitable" claim.
  • Block-level markdown injection — escape_markdown() only covered inline syntax. Line-leading #, ---, ===, +/- lists, and | tables passed through and rendered as real <h1>/<hr>/<table>, letting attacker free text impersonate system-alert banners. Now neutralized at the single choke point.
  • Double-backslash bypass closed — \ added to the escape class, so \*text\* can no longer reopen emphasis.

  Hardening / structural

  • New tests/test_formatters/test_escaping.py: a canary bundling every syntax class from all four audit rounds, asserted inert after both the app's escaping and Apprise's real markdown→HTML pipeline — a direct unit test plus a per-formatter sweep. Guards against future escape gaps re-appearing.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 1.5.4 6113816b45

  Compare

  1.5.4 Stable

  eric released this 2026-07-01 21:46:52 -07:00 | 2 commits to main since this release

  v1.5.4 - Security fix: HTML injection in notifications

  escape_markdown() escaped []()*_\`` but not </>`, so raw HTML tags in attacker-controlled commit messages, issue/PR/comment/review/release bodies, or titles rendered as live masked phishing links on Telegram and HTML-format email destinations (both default to HTML rendering). Not exploitable on Discord/Slack/Mattermost/Matrix/MSTeams/Rocket.Chat.

  Fix: </> now entity-encoded (</>) instead of backslash-escaped, since python-markdown doesn't honor \< as an escape.

  Upgrade recommended, especially if you notify via Telegram or email.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 1.5.3 08de137262

  Compare

  1.5.3 Stable

  eric released this 2026-07-01 17:04:37 -07:00 | 3 commits to main since this release

  v1.5.3 - Security fix: close remaining markdown injection gaps

  Follow-up security audit found the v1.5.2 markdown-escaping fix was incomplete — three call sites of the same injection pattern were missed. All three are fixed in this release.

  Fixed

  • Push commit messages could inject markdown links into push notifications. Any collaborator with ordinary push access could craft a commit message like Fix typo [Click here](https://evil.example/phish) and have it render as a clickable phishing link on markdown-aware notification targets (Discord, Mattermost, Telegram, Matrix, etc.).
  • Notification titles were never escaped, in any of the 28 event formatters — only body was. Attacker-controlled free text (release name, wiki page title, commit-status context, workflow/job name, package owner/label) could inject a masked link into the title. Confirmed exploitable against Mattermost unconditionally, and Telegram under this
    app's default NOTIFICATION_FORMAT=markdown.
  • link() didn't validate its URL argument. A crafted Gitea commit-status target_url (requires only ordinary repo write access, same tier as push) could break out of its markdown link and inject a second, fully attacker-controlled link plus fake bolded text into status notifications.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 1.5.2 85e2e933a5

  Compare

  1.5.2 Stable

  eric released this 2026-07-01 16:19:53 -07:00 | 4 commits to main since this release

  v1.5.2 - Security fixes: markdown injection, notification size cap bypass

  Fixes two issues found in an internal security audit. No config changes required — upgrade and redeploy.

  Fixed

  • Markdown link injection in notifications — A forge user's display name or free-text (comment/issue/PR/release/review body) containing markdown link syntax ([text](url)) was rendered as a real clickable link in the destination notification (Slack/Discord/Telegram/etc.), allowing phishing under the guise of a trusted automated message. All forge-controlled text is now escaped (escape_markdown() in app/formatters/base.py) before being interpolated into notification titles/bodies.
  • Notification size cap bypass — The app's declared 32KB notification limit (APPRISE_MAX_LEN) was never applied to title in any formatter, and was missing from body in 14 of 28 formatters, letting an oversized webhook payload produce a multi-megabyte notification. Truncation is now applied centrally in format_event(), so every event type is bounded consistently.

  Notes

  • No breaking changes, no new config vars, no migration needed.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads