Merge pull request 'Harden Discord delivery against mention injection' (#61) from koda/pr59-improvements-discord-mentions into codex/v0.5-webhook-notification/05-discord-webhook-delivery

Reviewed-on: OpenSource/KanbanGit#61

app/Actions/Notifications/DeliverNotificationAction.php

@@ -272,6 +272,9 @@ class DeliverNotificationAction implements ShouldQueue
             ->timeout(10)
             ->post($notificationAction->delivery_url, [
                 'content' => $message,
+                'allowed_mentions' => [
+                    'parse' => [],
+                ],
             ]);
     }
 

tests/Feature/Notifications/DeliverNotificationActionTest.php

@@ -89,6 +89,9 @@ class DeliverNotificationActionTest extends TestCase
                 && $request->hasHeader('Content-Type', 'application/json')
                 && $request->data() === [
                     'content' => 'CORE-42 moved from Backlog to Doing by Erica Example: https://kanbangit.test/projects/core/tickets/42 ($unknown)',
+                    'allowed_mentions' => [
+                        'parse' => [],
+                    ],
                 ];
         });