Teknium 469cd16fe0 fix(security): consolidated security hardening — SSRF, timing attack, tar traversal, credential leakage (#5944) ... Salvaged from PRs #5800 (memosr), #5806 (memosr), #5915 (Ruzzgar), #5928 (Awsh1). Changes: - Use hmac.compare_digest for API key comparison (timing attack prevention) - Apply provider env var blocklist to Docker containers (credential leakage) - Replace tar.extractall() with safe extraction in TerminalBench2 (CVE-2007-4559) - Add SSRF protection via is_safe_url to ALL platform adapters: base.py (cache_image_from_url, cache_audio_from_url), discord, slack, telegram, matrix, mattermost, feishu, wecom (Signal and WhatsApp protected via base.py helpers) - Update tests: mock is_safe_url in Mattermost download tests - Add security tests for tar extraction (traversal, symlinks, safe files)		2026-04-07 17:28:37 -07:00
..
__init__.py	Enhance CLI with multi-platform messaging integration and configuration management	2026-02-02 19:01:51 -08:00
ADDING_A_PLATFORM.md	docs: finish cron terminology cleanup	2026-03-14 19:20:58 -07:00
api_server.py	fix(security): consolidated security hardening — SSRF, timing attack, tar traversal, credential leakage (#5944)	2026-04-07 17:28:37 -07:00
base.py	fix(security): consolidated security hardening — SSRF, timing attack, tar traversal, credential leakage (#5944)	2026-04-07 17:28:37 -07:00
dingtalk.py	fix(dingtalk): requirements check passes with only one credential set	2026-03-17 03:50:45 -07:00
discord.py	fix(security): consolidated security hardening — SSRF, timing attack, tar traversal, credential leakage (#5944)	2026-04-07 17:28:37 -07:00
email.py	fix(email): close SMTP and IMAP connections on failure (#3804)	2026-03-29 15:38:32 -07:00
feishu.py	fix(security): consolidated security hardening — SSRF, timing attack, tar traversal, credential leakage (#5944)	2026-04-07 17:28:37 -07:00
homeassistant.py	fix(gateway): add request timeouts to HA, Email, Mattermost, SMS adapters (#3258)	2026-03-26 14:36:07 -07:00
matrix.py	fix(security): consolidated security hardening — SSRF, timing attack, tar traversal, credential leakage (#5944)	2026-04-07 17:28:37 -07:00
mattermost.py	fix(security): consolidated security hardening — SSRF, timing attack, tar traversal, credential leakage (#5944)	2026-04-07 17:28:37 -07:00
signal.py	fix(signal): implement send_image_file, send_voice, and send_video for MEDIA: tag delivery	2026-04-06 11:41:34 -07:00
slack.py	fix(security): consolidated security hardening — SSRF, timing attack, tar traversal, credential leakage (#5944)	2026-04-07 17:28:37 -07:00
sms.py	fix: store asyncio task references to prevent GC mid-execution (#3267)	2026-03-26 14:36:24 -07:00
telegram_network.py	fix(security): reject private and loopback IPs in Telegram DoH fallback (#4129)	2026-03-30 18:53:24 -07:00
telegram.py	fix(security): consolidated security hardening — SSRF, timing attack, tar traversal, credential leakage (#5944)	2026-04-07 17:28:37 -07:00
webhook.py	fix(gateway/webhook): don't pop delivery_info on send	2026-04-07 17:27:09 -07:00
wecom.py	fix(security): consolidated security hardening — SSRF, timing attack, tar traversal, credential leakage (#5944)	2026-04-07 17:28:37 -07:00
whatsapp.py	refactor: codebase-wide lint cleanup — unused imports, dead code, and inefficient patterns (#5821)	2026-04-07 10:25:31 -07:00