Thanks for the implementation — webhook and Discord delivery paths are well covered by tests. I left one should-fix issue inline (mention injection risk in Discord payloads).\n\nBuckets:\n- Blocker: none\n- Should fix: 1\n- Nit/Optional: none
Thanks for the implementation — webhook and Discord delivery paths are well covered by tests. I left one should-fix issue inline (mention injection risk in Discord payloads).\n\nBuckets:\n- Blocker: none\n- Should fix: 1\n- Nit/Optional: none
Should fix: Discord receives rendered ticket data from user-controlled fields ($ticket_title, $project_name, $actor_name) as raw content. Without allowed_mentions, values like @everyone / <@&role> will create real pings and enable mention-spam. Please include an explicit allowed_mentions policy (for example { "parse": [] }) or sanitize mention tokens before sending.
**Should fix:** Discord receives rendered ticket data from user-controlled fields (`$ticket_title`, `$project_name`, `$actor_name`) as raw `content`. Without `allowed_mentions`, values like `@everyone` / `<@&role>` will create real pings and enable mention-spam. Please include an explicit `allowed_mentions` policy (for example `{ "parse": [] }`) or sanitize mention tokens before sending.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Koda
Thanks for the implementation — webhook and Discord delivery paths are well covered by tests. I left one should-fix issue inline (mention injection risk in Discord payloads).\n\nBuckets:\n- Blocker: none\n- Should fix: 1\n- Nit/Optional: none
@@ -229,0 +271,4 @@->connectTimeout(5)->timeout(10)->post($notificationAction->delivery_url, ['content' => $message,Should fix: Discord receives rendered ticket data from user-controlled fields (
$ticket_title,$project_name,$actor_name) as rawcontent. Withoutallowed_mentions, values like@everyone/<@&role>will create real pings and enable mention-spam. Please include an explicitallowed_mentionspolicy (for example{ "parse": [] }) or sanitize mention tokens before sending.Here is the improvements PR: OpenSource/KanbanGit#61