eric
released this
2026-07-01 22:45:56 -07:00
| 1 commits to main since this release
v1.5.5
Security (run-4 audit fixes)
- HTML injection via branch/ref names in titles —
push, create, and delete events interpolated the git branch/ref into the notification title unescaped. Git refs permit <, >, and /, so a crafted branch name (e.g. <a/href="evil/x">click</a>) rendered as a live anchor in Telegram HTML. Now escaped. Corrects v1.5.4's incorrect "refs non-exploitable" claim.
- Block-level markdown injection —
escape_markdown() only covered inline syntax. Line-leading #, ---, ===, +/- lists, and | tables passed through and rendered as real <h1>/<hr>/<table>, letting attacker free text impersonate system-alert banners. Now neutralized at the single choke point.
- Double-backslash bypass closed —
\ added to the escape class, so \*text\* can no longer reopen emphasis.
Hardening / structural
- New
tests/test_formatters/test_escaping.py: a canary bundling every syntax class from all four audit rounds, asserted inert after both the app's escaping and Apprise's real markdown→HTML pipeline — a direct unit test plus a per-formatter sweep. Guards against future escape gaps re-appearing.
Downloads