Commit Graph

6 Commits

Author SHA1 Message Date
jamesread e5d29b68da fix: close shellAfterCompleted output injection bypass, and docs consistency
Rewrite all output/exitCode template forms to env refs and omit them
  from template args so command output cannot reach sh -c.
  (GHSA-vc6p)
2026-07-28 16:57:52 +01:00
jamesread 8eda67a39e fix(docs): correct shellAfterCompleted quoting for output and exitCode
The after-completion example put {{ output }} and {{ exitCode }} inside
  single-quoted shell arguments, so  and  never expanded
  after substituteShellAfterCompletedEnvRefs runs.
  Update the apprise sample to use printf-based quoting that allows env
  substitution, document the single-quote pitfall, and extend
  TestShellAfterCompletedUsesOutputEnvSafely to assert stdout is
  substituted as well as injection being blocked.
2026-07-08 14:01:43 +01:00
jamesread 4ef86abee7 security: GHSA-vc6p-m6vx-6cwq (HIGH) harden shellAfterCompleted execution
Route output and exitCode through OUTPUT/EXITCODE environment variables
instead of shell interpolation, and block shellAfterCompleted for webhook
actions.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-08 12:29:37 +01:00
jamesread cb5581e5eb docs: Major improvements in screenshots/layout 2026-06-19 16:43:23 +01:00
jamesread 633d9ecd82 feat: action group sizing 2026-06-18 23:33:27 +01:00
jamesread c132eacc00 docs: add Antora site sources under docs/ with CI smoke build
Move the docs.olivetin.app AsciiDoc component into this repository, add
local Antora playbooks for contributors and CI, and document the split
between this repo and the docs build repository.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-10 21:58:48 +01:00