hermes-agent/plugins/platforms
briandevans 8e6d1a9a53 fix(slack): stop double-decoding HTML entities when escaping message text
format_message unescapes already-escaped input before re-escaping, so that
pre-escaped text doesn't get double-escaped. That unescape was three
sequential str.replace calls, which re-scan each other's output:

    "&amp;lt;"  --(&amp; -> &)-->  "&lt;"  --(&lt; -> <)-->  "<"

The & produced by the first replace pairs with the following "lt;" and
decodes a second time. "&amp;lt;" is the wire form of the literal text
"&lt;", so the text is silently destroyed: Slack receives "&lt;" and renders
"<". Anyone writing about HTML or markup ("&amp;lt;b&amp;gt;" -> "<b>")
loses their literal text, with no error.

re.sub scans left-to-right and never re-scans its own replacements, so a
single pass fixes it. The escape pass on the next line is left untouched --
it is correctly ordered (& first, so the &s it inserts aren't re-escaped).

Only the double-decode cases change; every other input is byte-identical
before and after. This is the same round-trip invariant the neighbouring
test_pre_escaped_{ampersand,lt,gt}_not_double_escaped tests already assert,
extended to the case they miss. Affects the plain mrkdwn path (send,
edit_message) and Block Kit sections, which route section text through
format_message.
2026-07-23 11:50:28 -07:00
..
dingtalk fix(gateway): bridge nested DingTalk allowed_users into auth env 2026-07-20 05:39:24 -07:00
discord fix(state): refuse WAL on SQLite builds with the WAL-reset bug 2026-07-23 17:32:38 +05:30
email fix(email): harden adapter against malformed IMAP responses 2026-07-02 03:12:53 -07:00
feishu fix(security): guard remaining preflighted HTTP fetches 2026-07-23 11:44:43 -07:00
google_chat harden(slack): CDN-allowlist inbound file URLs, DNS-pin token downloads, widen token-file perms warning 2026-07-23 11:44:43 -07:00
homeassistant fix(gateway): validate multiplex adapter config by platform 2026-07-16 05:39:58 -07:00
irc fix(telegram): preserve Bot API update queue on watcher reconnect 2026-06-25 21:29:57 -07:00
line fix(security): widen non-ASCII compare_digest crash fix to all sibling sites 2026-07-16 07:22:24 -07:00
matrix fix(security): pin DNS resolutions for SSRF-safe fetches 2026-07-23 11:44:43 -07:00
mattermost Harden gateway mass mention handling 2026-07-22 21:14:44 -07:00
ntfy fix(telegram): preserve Bot API update queue on watcher reconnect 2026-06-25 21:29:57 -07:00
photon fix(photon): hide the npm dep self-heal console flashes on Windows too 2026-07-16 01:03:43 -07:00
raft fix(security): widen non-ASCII compare_digest crash fix to all sibling sites 2026-07-16 07:22:24 -07:00
simplex fix(telegram): preserve Bot API update queue on watcher reconnect 2026-06-25 21:29:57 -07:00
slack fix(slack): stop double-decoding HTML entities when escaping message text 2026-07-23 11:50:28 -07:00
sms fix(security): widen non-ASCII compare_digest crash fix to all sibling sites 2026-07-16 07:22:24 -07:00
teams fix(security): pin DNS resolutions for SSRF-safe fetches 2026-07-23 11:44:43 -07:00
telegram fix(security): guard remaining preflighted HTTP fetches 2026-07-23 11:44:43 -07:00
wecom fix(security): guard remaining preflighted HTTP fetches 2026-07-23 11:44:43 -07:00
whatsapp fix(gateway): gate profile routing on multiplex_profiles + widen batch-key routing to all adapters 2026-07-15 09:50:05 -07:00