5 releases 9 tags

RSS feed

• 1.5.2 85e2e933a5

  Compare

  1.5.2 Stable

  eric released this 2026-07-01 16:19:53 -07:00 | 4 commits to main since this release

  v1.5.2 - Security fixes: markdown injection, notification size cap bypass

  Fixes two issues found in an internal security audit. No config changes required — upgrade and redeploy.

  Fixed

  • Markdown link injection in notifications — A forge user's display name or free-text (comment/issue/PR/release/review body) containing markdown link syntax ([text](url)) was rendered as a real clickable link in the destination notification (Slack/Discord/Telegram/etc.), allowing phishing under the guise of a trusted automated message. All forge-controlled text is now escaped (escape_markdown() in app/formatters/base.py) before being interpolated into notification titles/bodies.
  • Notification size cap bypass — The app's declared 32KB notification limit (APPRISE_MAX_LEN) was never applied to title in any formatter, and was missing from body in 14 of 28 formatters, letting an oversized webhook payload produce a multi-megabyte notification. Truncation is now applied centrally in format_event(), so every event type is bounded consistently.

  Notes

  • No breaking changes, no new config vars, no migration needed.

  Downloads

  • Source code (ZIP)
    3 downloads
  • Source code (TAR.GZ)
    3 downloads