From 41cecde7353d837240af659e0419f45f9f4e0199 Mon Sep 17 00:00:00 2001 From: Yash Kumar Date: Fri, 16 Oct 2026 16:09:00 +0530 Subject: [PATCH] fix: escape metadata fields and fix entity boundary off-by-one --- packages/server/src/utils/notifications/build-error.ts | 3 ++- packages/server/src/utils/notifications/build-success.ts | 3 ++- packages/server/src/utils/notifications/database-backup.ts | 3 ++- packages/server/src/utils/notifications/dokploy-backup.ts | 3 ++- packages/server/src/utils/notifications/server-threshold.ts | 2 +- packages/server/src/utils/notifications/volume-backup.ts | 5 +++-- 6 files changed, 12 insertions(+), 7 deletions(-) diff --git a/packages/server/src/utils/notifications/build-error.ts b/packages/server/src/utils/notifications/build-error.ts index 51c10232b..465a7c006 100644 --- a/packages/server/src/utils/notifications/build-error.ts +++ b/packages/server/src/utils/notifications/build-error.ts @@ -5,6 +5,7 @@ import { render } from "@react-email/components"; import { format } from "date-fns"; import { and, eq } from "drizzle-orm"; import { + escapeHtml, formatTelegramErrorMessage, sendCustomNotification, sendDiscordNotification, @@ -202,7 +203,7 @@ export const sendBuildErrorNotifications = async ({ await sendTelegramNotification( telegram, - `⚠️ Build Failed\n\nProject: ${projectName}\nApplication: ${applicationName}\nType: ${applicationType}\nDate: ${format(date, "PP")}\nTime: ${format(date, "pp")}\n\nError:\n
${formatTelegramErrorMessage(errorMessage)}
`, + `⚠️ Build Failed\n\nProject: ${escapeHtml(projectName)}\nApplication: ${escapeHtml(applicationName)}\nType: ${escapeHtml(applicationType)}\nDate: ${format(date, "PP")}\nTime: ${format(date, "pp")}\n\nError:\n
${formatTelegramErrorMessage(errorMessage)}
`, inlineButton, ); } diff --git a/packages/server/src/utils/notifications/build-success.ts b/packages/server/src/utils/notifications/build-success.ts index 13ed68a77..658acdc9b 100644 --- a/packages/server/src/utils/notifications/build-success.ts +++ b/packages/server/src/utils/notifications/build-success.ts @@ -6,6 +6,7 @@ import { render } from "@react-email/components"; import { format } from "date-fns"; import { and, eq } from "drizzle-orm"; import { + escapeHtml, sendCustomNotification, sendDiscordNotification, sendEmailNotification, @@ -214,7 +215,7 @@ export const sendBuildSuccessNotifications = async ({ await sendTelegramNotification( telegram, - `✅ Build Success\n\nProject: ${projectName}\nApplication: ${applicationName}\nEnvironment: ${environmentName}\nType: ${applicationType}\nDate: ${format( + `✅ Build Success\n\nProject: ${escapeHtml(projectName)}\nApplication: ${escapeHtml(applicationName)}\nEnvironment: ${escapeHtml(environmentName)}\nType: ${escapeHtml(applicationType)}\nDate: ${format( date, "PP", )}\nTime: ${format(date, "pp")}`, diff --git a/packages/server/src/utils/notifications/database-backup.ts b/packages/server/src/utils/notifications/database-backup.ts index 70c111947..e6b8ffa60 100644 --- a/packages/server/src/utils/notifications/database-backup.ts +++ b/packages/server/src/utils/notifications/database-backup.ts @@ -5,6 +5,7 @@ import { render } from "@react-email/components"; import { format } from "date-fns"; import { and, eq } from "drizzle-orm"; import { + escapeHtml, formatTelegramErrorMessage, sendCustomNotification, sendDiscordNotification, @@ -212,7 +213,7 @@ export const sendDatabaseBackupNotifications = async ({ ? `\n\nError:\n
${formatTelegramErrorMessage(errorMessage)}
` : ""; - const messageText = `${statusEmoji} Database Backup ${typeStatus}\n\nProject: ${projectName}\nApplication: ${applicationName}\nType: ${databaseType}\nDatabase Name: ${databaseName}\nDate: ${format(date, "PP")}\nTime: ${format(date, "pp")}${isError ? errorMsg : ""}`; + const messageText = `${statusEmoji} Database Backup ${typeStatus}\n\nProject: ${escapeHtml(projectName)}\nApplication: ${escapeHtml(applicationName)}\nType: ${escapeHtml(databaseType)}\nDatabase Name: ${escapeHtml(databaseName)}\nDate: ${format(date, "PP")}\nTime: ${format(date, "pp")}${isError ? errorMsg : ""}`; await sendTelegramNotification(telegram, messageText); } diff --git a/packages/server/src/utils/notifications/dokploy-backup.ts b/packages/server/src/utils/notifications/dokploy-backup.ts index ab5e8a22e..07048c8df 100644 --- a/packages/server/src/utils/notifications/dokploy-backup.ts +++ b/packages/server/src/utils/notifications/dokploy-backup.ts @@ -5,6 +5,7 @@ import { render } from "@react-email/components"; import { format } from "date-fns"; import { eq } from "drizzle-orm"; import { + escapeHtml, formatTelegramErrorMessage, sendCustomNotification, sendDiscordNotification, @@ -190,7 +191,7 @@ export const sendDokployBackupNotifications = async ({ ? `\n\nError:\n
${formatTelegramErrorMessage(errorMessage)}
` : ""; const sizeInfo = backupSize - ? `\nBackup Size: ${backupSize}` + ? `\nBackup Size: ${escapeHtml(backupSize)}` : ""; const messageText = `${statusEmoji} Dokploy Backup ${typeStatus}\n\nBackup Type: Complete Dokploy Instance${sizeInfo}\nDate: ${format(date, "PP")}\nTime: ${format(date, "pp")}${isError ? errorMsg : ""}`; diff --git a/packages/server/src/utils/notifications/server-threshold.ts b/packages/server/src/utils/notifications/server-threshold.ts index a32217204..4e829f79e 100644 --- a/packages/server/src/utils/notifications/server-threshold.ts +++ b/packages/server/src/utils/notifications/server-threshold.ts @@ -190,7 +190,7 @@ export const sendServerThresholdNotifications = async ( telegram, ` ⚠️ Server ${payload.Type} Alert - Server Name: ${payload.ServerName} + Server Name: ${escapeHtml(payload.ServerName)} Type: ${payload.Type} Current Value: ${payload.Value.toFixed(2)}% Threshold: ${payload.Threshold.toFixed(2)}% diff --git a/packages/server/src/utils/notifications/volume-backup.ts b/packages/server/src/utils/notifications/volume-backup.ts index 2eb9c3c5f..54f9b97a4 100644 --- a/packages/server/src/utils/notifications/volume-backup.ts +++ b/packages/server/src/utils/notifications/volume-backup.ts @@ -5,6 +5,7 @@ import { render } from "@react-email/components"; import { format } from "date-fns"; import { and, eq } from "drizzle-orm"; import { + escapeHtml, formatTelegramErrorMessage, sendCustomNotification, sendDiscordNotification, @@ -227,10 +228,10 @@ export const sendVolumeBackupNotifications = async ({ ? `\n\nError:\n
${formatTelegramErrorMessage(errorMessage)}
` : ""; const sizeInfo = backupSize - ? `\nBackup Size: ${backupSize}` + ? `\nBackup Size: ${escapeHtml(backupSize)}` : ""; - const messageText = `${statusEmoji} Volume Backup ${typeStatus}\n\nProject: ${projectName}\nApplication: ${applicationName}\nVolume Name: ${volumeName}\nService Type: ${serviceType}${sizeInfo}\nDate: ${format(date, "PP")}\nTime: ${format(date, "pp")}${isError ? errorMsg : ""}`; + const messageText = `${statusEmoji} Volume Backup ${typeStatus}\n\nProject: ${escapeHtml(projectName)}\nApplication: ${escapeHtml(applicationName)}\nVolume Name: ${escapeHtml(volumeName)}\nService Type: ${escapeHtml(serviceType)}${sizeInfo}\nDate: ${format(date, "PP")}\nTime: ${format(date, "pp")}${isError ? errorMsg : ""}`; await sendTelegramNotification(telegram, messageText); }