rcourtman
6a48c759e8
Fix critical notification system bugs and security issues
...
This commit addresses multiple critical issues identified in the notification
system audit conducted with Codex:
**Critical Fixes:**
1. **Queue Retry Logic (Critical #1 )**
- Fixed broken retry/DLQ system where send functions never returned errors
- Made sendGroupedEmail(), sendGroupedWebhook(), sendGroupedApprise() return errors
- Made sendWebhookRequest() return errors
- ProcessQueuedNotification() now properly propagates errors to queue
- Retry logic and DLQ now function correctly
2. **Attempt Counter Bug (Critical #2 )**
- Fixed double-increment bug in queue processing
- Separated UpdateStatus() from attempt tracking
- Added IncrementAttempt() method
- Notifications now get correct number of retry attempts
3. **Secret Exposure (Critical #3 & #4 )**
- Masked webhook headers and customFields in GET /api/notifications/webhooks
- Added redactSecretsFromURL() to sanitize webhook URLs in history
- Truncated/redacted response bodies in webhook history
- Protected against credential harvesting via API
4. **Email Rate Limiting (Critical #5 )**
- Added emailManager field to NotificationManager
- Shared EnhancedEmailManager instance across sends
- Rate limiter now accumulates across multiple emails
- SMTP rate limits are now enforced correctly
5. **SSRF Protection (High #6 )**
- Added DNS resolution of webhook URLs
- Added isPrivateIP() check using CIDR ranges
- Blocks all private IP ranges (10/8, 172.16/12, 192.168/16, 127/8, 169.254/16)
- Blocks IPv6 private ranges (::1, fe80::/10, fc00::/7)
- Prevents DNS rebinding attacks
- Returns error instead of warning for private IPs
**New Features:**
6. **Health Endpoint (High #8 )**
- Added GET /api/notifications/health
- Returns queue stats (pending, sending, sent, failed, dlq)
- Shows email/webhook configuration status
- Provides overall health indicator
**Related to notification system audit**
Files changed:
- internal/notifications/notifications.go: Error returns, rate limiting, SSRF hardening
- internal/notifications/queue.go: Attempt tracking fix
- internal/api/notifications.go: Secret masking, health endpoint
2025-11-06 23:26:03 +00:00
