zapabob 2e08b778ab fix(security): validate inbound Slack file URLs against SSRF ... _download_slack_file and _download_slack_file_bytes fetched Slack-supplied URLs with the bot token attached and follow_redirects=True, but without the is_safe_url pre-flight check or per-redirect guard that the outbound send_image path already uses. A URL that resolves to (or 3xx-redirects into) a private/internal address could reach internal services and leak the bot token (CWE-918). Add the same pre-flight + _ssrf_redirect_guard hook to both inbound sibling paths.		2026-07-23 11:44:43 -07:00
..
__init__.py	refactor(gateway): migrate slack/dingtalk/whatsapp/matrix/feishu/telegram/wecom/email/sms adapters to bundled plugins	2026-06-20 10:26:45 -07:00
adapter.py	fix(security): validate inbound Slack file URLs against SSRF	2026-07-23 11:44:43 -07:00
block_kit.py	fix(slack): sanitize outbound Block Kit payloads at the API boundary	2026-07-22 06:58:34 -07:00
plugin.yaml	Add Slack thread mention gating	2026-07-22 21:14:44 -07:00