zapabob 2e08b778ab fix(security): validate inbound Slack file URLs against SSRF ... _download_slack_file and _download_slack_file_bytes fetched Slack-supplied URLs with the bot token attached and follow_redirects=True, but without the is_safe_url pre-flight check or per-redirect guard that the outbound send_image path already uses. A URL that resolves to (or 3xx-redirects into) a private/internal address could reach internal services and leak the bot token (CWE-918). Add the same pre-flight + _ssrf_redirect_guard hook to both inbound sibling paths.		2026-07-23 11:44:43 -07:00
..
dingtalk	fix(gateway): bridge nested DingTalk allowed_users into auth env	2026-07-20 05:39:24 -07:00
discord	fix(state): refuse WAL on SQLite builds with the WAL-reset bug	2026-07-23 17:32:38 +05:30
email	fix(email): harden adapter against malformed IMAP responses	2026-07-02 03:12:53 -07:00
feishu	fix(security): guard remaining preflighted HTTP fetches	2026-07-23 11:44:43 -07:00
google_chat	rip out brew + pip/PyPI wheel support (#68217)	2026-07-22 16:51:01 -04:00
homeassistant	fix(gateway): validate multiplex adapter config by platform	2026-07-16 05:39:58 -07:00
irc	fix(telegram): preserve Bot API update queue on watcher reconnect	2026-06-25 21:29:57 -07:00
line	fix(security): widen non-ASCII compare_digest crash fix to all sibling sites	2026-07-16 07:22:24 -07:00
matrix	fix(security): pin DNS resolutions for SSRF-safe fetches	2026-07-23 11:44:43 -07:00
mattermost	Harden gateway mass mention handling	2026-07-22 21:14:44 -07:00
ntfy	fix(telegram): preserve Bot API update queue on watcher reconnect	2026-06-25 21:29:57 -07:00
photon	fix(photon): hide the npm dep self-heal console flashes on Windows too	2026-07-16 01:03:43 -07:00
raft	fix(security): widen non-ASCII compare_digest crash fix to all sibling sites	2026-07-16 07:22:24 -07:00
simplex	fix(telegram): preserve Bot API update queue on watcher reconnect	2026-06-25 21:29:57 -07:00
slack	fix(security): validate inbound Slack file URLs against SSRF	2026-07-23 11:44:43 -07:00
sms	fix(security): widen non-ASCII compare_digest crash fix to all sibling sites	2026-07-16 07:22:24 -07:00
teams	fix(security): pin DNS resolutions for SSRF-safe fetches	2026-07-23 11:44:43 -07:00
telegram	fix(security): guard remaining preflighted HTTP fetches	2026-07-23 11:44:43 -07:00
wecom	fix(security): guard remaining preflighted HTTP fetches	2026-07-23 11:44:43 -07:00
whatsapp	fix(gateway): gate profile routing on multiplex_profiles + widen batch-key routing to all adapters	2026-07-15 09:50:05 -07:00