eric/apprise-forge-notifications
Watch
1
0
Fork
You've already forked apprise-forge-notifications
 0
Code Issues Pull requests Projects Releases 12 Packages 1 Wiki Activity Actions
12 releases 12 tags
  • 1.6.2 991da94ad5

    1.6.2
    All checks were successful
    test / test (push) Successful in 24s
    Details
    Build and Publish Docker Image / build-and-push (push) Successful in 2m34s
    Details
    Stable

    eric released this 2026-10-27 22:27:54 -07:00 | 1 commits to main since this release

    What's new

    • Multi-arch images. Every tag now ships for linux/amd64, linux/arm64 (Raspberry Pi 3/4/5 and Zero 2 W on a 64-bit OS, other ARMv8 boards) and linux/arm/v7 (32-bit Raspberry Pi OS, other ARMv7 boards). Docker picks the right variant automatically, so the same image: line works everywhere.

    Fixes

    • Container healthcheck always failed. The HEALTHCHECK probed http://localhost:5000/health. Inside the container localhost resolves to ::1 first, but uvicorn listens on IPv4 only, so the probe got "connection refused" and every image, amd64 included, reported unhealthy even when the bridge was working. It now probes 127.0.0.1. Anything that waits on container health (e.g. Compose depends_on: condition: service_healthy, autoheal tools) now behaves correctly.

    Notes

    • On linux/arm/v7 the image installs plain uvicorn instead of uvicorn[standard], because uvloop and httptools publish no wheels for that platform. uvicorn falls back to asyncio and the pure-Python h11 parser; behaviour is identical.
    • No configuration changes. Pull the new image and recreate the container.
    Downloads
  • 1.6.1 030906b83c

    1.6.1
    All checks were successful
    test / test (push) Successful in 23s
    Details
    Build and Publish Docker Image / build-and-push (push) Successful in 54s
    Details
    Stable

    eric released this 2026-10-23 20:23:58 -07:00 | 4 commits to main since this release

    1.6.1: tag-driven releases, weekly rebuild, apk upgrade of the base image

    Downloads
  • 1.6.0 8fbf04ff4a

    1.6.0
    All checks were successful
    Build and Publish Docker Image / test (push) Successful in 24s
    Details
    Build and Publish Docker Image / build-and-push (push) Successful in 14s
    Details
    Stable

    eric released this 2026-10-15 17:04:11 -07:00 | 6 commits to main since this release

    Support Forgejo 17 workflow run/job webhooks (workflow_run_ / workflow_job_). Legacy action_run_* events still handled but are deprecated upstream — switch webhooks to the new triggers. Closes #6.

    Downloads
  • 1.5.6 5baa33df85

    1.5.6
    All checks were successful
    Build and Publish Docker Image / test (push) Successful in 25s
    Details
    Build and Publish Docker Image / build-and-push (push) Successful in 16s
    Details
    Stable

    eric released this 2026-07-02 10:03:16 -07:00 | 7 commits to main since this release

    v1.5.6 - Security hardening

    Fixes from the 5th security audit. Malformed/attacker input that used to trigger HTTP 500 now returns a proper 4xx. No auth bypass existed — all crash paths already failed closed. Drop-in upgrade, no config changes.

    • Non-ASCII Authorization / X-*-Signature headers → 403 (was 500)
    • Deeply-nested JSON → 400 (was 500)
    • Non-object / type-confused JSON payloads → 400 (was 500), across all 24 formatters
    • Log injection hardened: control chars in X-*-Delivery, event-type, and Apprise response bodies are escaped before logging
    • 10 regression tests added; suite 140 passing
    Downloads
  • 1.5.5 8f8567a97c

    1.5.5
    All checks were successful
    Build and Publish Docker Image / test (push) Successful in 22s
    Details
    Build and Publish Docker Image / build-and-push (push) Successful in 14s
    Details
    Stable

    eric released this 2026-07-01 22:45:56 -07:00 | 8 commits to main since this release

    v1.5.5

    Security (run-4 audit fixes)

    • HTML injection via branch/ref names in titles — push, create, and delete events interpolated the git branch/ref into the notification title unescaped. Git refs permit <, >, and /, so a crafted branch name (e.g. <a/href="evil/x">click</a>) rendered as a live anchor in Telegram HTML. Now escaped. Corrects v1.5.4's incorrect "refs non-exploitable" claim.
    • Block-level markdown injection — escape_markdown() only covered inline syntax. Line-leading #, ---, ===, +/- lists, and | tables passed through and rendered as real <h1>/<hr>/<table>, letting attacker free text impersonate system-alert banners. Now neutralized at the single choke point.
    • Double-backslash bypass closed — \ added to the escape class, so \*text\* can no longer reopen emphasis.

    Hardening / structural

    • New tests/test_formatters/test_escaping.py: a canary bundling every syntax class from all four audit rounds, asserted inert after both the app's escaping and Apprise's real markdown→HTML pipeline — a direct unit test plus a per-formatter sweep. Guards against future escape gaps re-appearing.
    Downloads
  • 1.5.4 6113816b45

    1.5.4
    All checks were successful
    Build and Publish Docker Image / test (push) Successful in 24s
    Details
    Build and Publish Docker Image / build-and-push (push) Successful in 15s
    Details
    Stable

    eric released this 2026-07-01 21:46:52 -07:00 | 9 commits to main since this release

    v1.5.4 - Security fix: HTML injection in notifications

    escape_markdown() escaped []()*_\`` but not </>`, so raw HTML tags in attacker-controlled commit messages, issue/PR/comment/review/release bodies, or titles rendered as live masked phishing links on Telegram and HTML-format email destinations (both default to HTML rendering). Not exploitable on Discord/Slack/Mattermost/Matrix/MSTeams/Rocket.Chat.

    Fix: </> now entity-encoded (&lt;/&gt;) instead of backslash-escaped, since python-markdown doesn't honor \< as an escape.

    Upgrade recommended, especially if you notify via Telegram or email.

    Downloads
  • 1.5.3 08de137262

    1.5.3
    All checks were successful
    Build and Publish Docker Image / test (push) Successful in 23s
    Details
    Build and Publish Docker Image / build-and-push (push) Successful in 15s
    Details
    Stable

    eric released this 2026-07-01 17:04:37 -07:00 | 10 commits to main since this release

    v1.5.3 - Security fix: close remaining markdown injection gaps

    Follow-up security audit found the v1.5.2 markdown-escaping fix was incomplete — three call sites of the same injection pattern were missed. All three are fixed in this release.

    Fixed

    • Push commit messages could inject markdown links into push notifications. Any collaborator with ordinary push access could craft a commit message like Fix typo [Click here](https://evil.example/phish) and have it render as a clickable phishing link on markdown-aware notification targets (Discord, Mattermost, Telegram, Matrix, etc.).
    • Notification titles were never escaped, in any of the 28 event formatters — only body was. Attacker-controlled free text (release name, wiki page title, commit-status context, workflow/job name, package owner/label) could inject a masked link into the title. Confirmed exploitable against Mattermost unconditionally, and Telegram under this
      app's default NOTIFICATION_FORMAT=markdown.
    • link() didn't validate its URL argument. A crafted Gitea commit-status target_url (requires only ordinary repo write access, same tier as push) could break out of its markdown link and inject a second, fully attacker-controlled link plus fake bolded text into status notifications.
    Downloads
  • 1.5.2 85e2e933a5

    1.5.2
    All checks were successful
    Build and Publish Docker Image / test (push) Successful in 26s
    Details
    Build and Publish Docker Image / build-and-push (push) Successful in 16s
    Details
    Stable

    eric released this 2026-07-01 16:19:53 -07:00 | 11 commits to main since this release

    v1.5.2 - Security fixes: markdown injection, notification size cap bypass

    Fixes two issues found in an internal security audit. No config changes required — upgrade and redeploy.

    Fixed

    • Markdown link injection in notifications — A forge user's display name or free-text (comment/issue/PR/release/review body) containing markdown link syntax ([text](url)) was rendered as a real clickable link in the destination notification (Slack/Discord/Telegram/etc.), allowing phishing under the guise of a trusted automated message. All forge-controlled text is now escaped (escape_markdown() in app/formatters/base.py) before being interpolated into notification titles/bodies.
    • Notification size cap bypass — The app's declared 32KB notification limit (APPRISE_MAX_LEN) was never applied to title in any formatter, and was missing from body in 14 of 28 formatters, letting an oversized webhook payload produce a multi-megabyte notification. Truncation is now applied centrally in format_event(), so every event type is bounded consistently.

    Notes

    • No breaking changes, no new config vars, no migration needed.
    Downloads
  • 1.1.3 c2bfd52144

    1.1.3 Stable

    eric released this 2026-03-14 16:21:37 -07:00 | 30 commits to main since this release

    Merge pull request 'v1.1.3: Review 004 fixes — config validation, dead code, test quality' (#6) from v1.1.3-fixes into main

    Reviewed-on: eric/apprise-gitea-notifications#6

    Downloads
  • 1.1.2 bb0ecb96f8

    1.1.2 Stable

    eric released this 2026-03-14 00:10:22 -07:00 | 39 commits to main since this release

    Merge pull request 'Reliability, observability, and CI improvements (v1.1.2)' (#2) from v1.1.2-fixes into main

    Reviewed-on: eric/apprise-gitea-notifications#2

    Downloads