Alix-007 940b69b1a8 fix(sms): bound Twilio webhook body reads to prevent OOM ... _handle_webhook() called request.read() with no size guard. Since the endpoint is publicly reachable, an attacker can send an arbitrarily large POST body to exhaust gateway memory. Add _TWILIO_WEBHOOK_MAX_BODY_BYTES (64 KiB — well above any real Twilio payload) and gate on both Content-Length and actual read size, returning HTTP 413 with an empty TwiML Response on oversized requests. Mirrors the guard already present in the Raft adapter.		2026-07-05 17:38:36 -07:00
..
dingtalk	fix(telegram): preserve Bot API update queue on watcher reconnect	2026-06-25 21:29:57 -07:00
discord	fix(discord): dedup saturated mid-stream overflow previews to stop edit-rate-limit storms	2026-07-05 13:58:11 -07:00
email	fix(email): harden adapter against malformed IMAP responses	2026-07-02 03:12:53 -07:00
feishu	fix(feishu): send WebSocket CLOSE frame on disconnect (#10202)	2026-07-05 13:49:50 -07:00
google_chat	fix: remove dead f-string prefixes via ruff F541 (216 sites) (#52336)	2026-07-05 13:42:46 -07:00
homeassistant	fix(telegram): preserve Bot API update queue on watcher reconnect	2026-06-25 21:29:57 -07:00
irc	fix(telegram): preserve Bot API update queue on watcher reconnect	2026-06-25 21:29:57 -07:00
line	fix(telegram): preserve Bot API update queue on watcher reconnect	2026-06-25 21:29:57 -07:00
matrix	fix(matrix): isolate per-event failures in _dispatch_sync gather	2026-07-03 03:27:47 -07:00
mattermost	fix(mattermost): accept leading-space slash commands	2026-07-05 14:41:57 -07:00
ntfy	fix(telegram): preserve Bot API update queue on watcher reconnect	2026-06-25 21:29:57 -07:00
photon	fix(photon): bound the sidecar dep self-heal npm run with a timeout	2026-07-05 17:38:32 -07:00
raft	security(raft): enforce body-size limit on chunked requests	2026-07-05 13:57:37 -07:00
simplex	fix(telegram): preserve Bot API update queue on watcher reconnect	2026-06-25 21:29:57 -07:00
slack	fix(slack): MPIMs (group DMs) obey shared-surface mention gating + reaction guard	2026-07-03 12:34:53 +05:30
sms	fix(sms): bound Twilio webhook body reads to prevent OOM	2026-07-05 17:38:36 -07:00
teams	security(gateway): set explicit client_max_size on 3 uncapped aiohttp servers (#59180)	2026-07-05 14:48:28 -07:00
telegram	fix(telegram): redact bot token from connect/disconnect/send_document/send_video errors	2026-07-05 13:57:28 -07:00
wecom	fix(gateway): fail-closed external-surface defaults + profile-aware multiplex authz	2026-07-01 03:56:28 -07:00
whatsapp	feat(whatsapp): native Baileys polls, clarify-as-poll, locations, and rich inbound metadata	2026-07-05 06:27:20 -07:00