From 7f5f8110669e71ab32c8ef52c0556594428d7049 Mon Sep 17 00:00:00 2001 From: Koda Date: Fri, 24 Apr 2026 16:42:11 +0000 Subject: [PATCH] Prevent Discord mention injection in delivery payload --- app/Actions/Notifications/DeliverNotificationAction.php | 3 +++ tests/Feature/Notifications/DeliverNotificationActionTest.php | 3 +++ 2 files changed, 6 insertions(+) diff --git a/app/Actions/Notifications/DeliverNotificationAction.php b/app/Actions/Notifications/DeliverNotificationAction.php index 25783f4..58f642c 100644 --- a/app/Actions/Notifications/DeliverNotificationAction.php +++ b/app/Actions/Notifications/DeliverNotificationAction.php @@ -272,6 +272,9 @@ class DeliverNotificationAction implements ShouldQueue ->timeout(10) ->post($notificationAction->delivery_url, [ 'content' => $message, + 'allowed_mentions' => [ + 'parse' => [], + ], ]); } diff --git a/tests/Feature/Notifications/DeliverNotificationActionTest.php b/tests/Feature/Notifications/DeliverNotificationActionTest.php index 84fe9a0..87a0185 100644 --- a/tests/Feature/Notifications/DeliverNotificationActionTest.php +++ b/tests/Feature/Notifications/DeliverNotificationActionTest.php @@ -89,6 +89,9 @@ class DeliverNotificationActionTest extends TestCase && $request->hasHeader('Content-Type', 'application/json') && $request->data() === [ 'content' => 'CORE-42 moved from Backlog to Doing by Erica Example: https://kanbangit.test/projects/core/tickets/42 ($unknown)', + 'allowed_mentions' => [ + 'parse' => [], + ], ]; }); -- 2.54.0