Repository navigation
fix(notify): escape breach source data in alerts - #25
Merged
Merged
Conversation
Breach names and data types come from external sources, some of them dark web aggregators, and reached every alert channel as they were. A crafted name could inject a fake link into the administrator's email, ping a whole Slack channel with <!channel> or render a disguised link in Slack and Teams, and forge a new event in the SIEM export with a line break. The alert email escapes every value. Slack and Teams escape their control characters and show source values as inline code. CEF and syslog keep each event on one line. Refs #24
This was referenced Oct 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Breach names and data types come from external sources, some of them dark web aggregators, and reached every alert channel unescaped.
<!channel>pinged the whole channel,<https://...|text>rendered a disguised link& < >escaped, source values shown as inline code[text](url)rendered a disguised linkScheduled reports already escaped their values, and the other emails only carry values Gardik generates. The generic JSON webhook still sends raw values: its consumer parses JSON, it does not render it.
The Teams rendering of inline code follows the MessageCard markdown support; it is covered by unit tests but was not checked against a live Teams channel.
Type of change
Checklist
tsc --noEmit, 324 unit tests.