clawbot
15a61173fc
All checks were successful
check / check (push) Superseded by a newer commit; never tested
The page rendered the stored target config verbatim, exposing the Slack incoming-webhook URL, which is a bearer credential: anyone holding it can post to the channel indefinitely, and it cannot be scoped or revoked per-holder. Target config now reaches the template only as a TargetView carrying labelled fields, so no code path can render the raw blob. maskURL keeps scheme and host and elides the path, and drops query, fragment and userinfo; every parse failure yields a neutral placeholder rather than falling back to the stored string. HTTP header values are never rendered, only a count. Rendering change only: the stored config format and the delivery path are unchanged.
6.2 KiB
6.2 KiB