go-pkgz / notify / 32195201290

97%

push

github

Fix secret leaks and HTTP handling in notifiers (#39)

* Stop leaking bot token and shared connections in telegram requests

Token is a part of every API URL, so any transport failure returns
*url.Error with the token in it, and callers logging that error leak the
credential. Request now replaces the token with <redacted> in the URL,
keeping the operation, the cause and the timeout detection intact.

Each request also closed idle connections of http.DefaultTransport, which
dropped keep-alive connections of every other user of the default
transport in the process, telegram polling included.

sendText escaped the message with PathEscape, so "+" and "&" in ErrorMsg
or SuccessMsg were mangled by the query parser, QueryEscape is correct here.

Also set the content-type header after the request creation error check,
it panicked on nil request when the URL failed to parse.

* Hide header values and bound response body in webhook

String printed configured headers verbatim, so logging the notifier
exposed authorization tokens; it reports the header count now.

Response body of a non-OK response was read without a limit, and the body
of an OK response was not drained, preventing connection reuse. Error body
is capped at 16k with a truncation marker, the rest is drained.

Header values are split on the first colon only, values with colons in
them, URLs for example, were silently dropped before.

* Send slack attachment when title is not set

Attachment was added only with a title set, so attachmentText alone was
silently dropped, contrary to what README documents. It is sent whenever
the attachment carries content now, a title or a text: titleLink on its
own is not enough, slack renders it as a link on the title and has
nothing to put it on without one.

* Fix README example and add runnable webhook example

Main README example had an extra closing parenthesis and did not compile.
Added ExampleSend covering the same flow against a local test server, as
webhook ... (continued)

23 of 27 new or added lines in 3 files covered. (85.19%)

483 of 503 relevant lines covered (96.02%)

9.98 hits per line