v1.0.6

Security Hardening Release

6 security fixes from adversarial pre-ship review + sentinel review:

P2 (release-blocking):

• _alert_slack_post_message: JSON-escape channel value before awk interpolation — prevents JSON injection from channel names containing " or \

P3 (defense-in-depth):

• _alert_email_local: CR/LF stripping on all header values (recip, subject, from, reply-to) — prevents header injection if called outside _alert_deliver_email
• _alert_deliver_email: CR/LF stripping on reply-to, recip, and from in relay path — parity with local MTA path
• _alert_slack_upload: validate upload URL is HTTPS before uploading file content — rejects http, file, ftp schemes
• _alert_slack_upload: case-insensitive HTTPS validation — extended case pattern for bash 4.1 compatibility
• _alert_slack_upload: --data-urlencode for filename parameter — prevents form parameter injection from filenames containing &

Testing:

• 7 new security regression tests (253 → 260 total)
• batsman submodule 1.0.3 → 1.4.0

Consumers: BFD and LMD should update their alert_lib submodule/copy to v1.0.6.

v1.0.5

• 1.0.5 | Mar 16 2026:

  [Fix] All rm -f calls use 'command rm -f' to bypass potential user aliases
  on target systems; 17 instances across all delivery and cleanup paths
  [Fix] _alert_slack_upload: JSON-escape $channels and $file_id in
  completeUploadExternal request body; prevents malformed JSON from
  channel names containing special characters
  [Fix] _alert_slack_post_message: replace awk -v with ENVIRON pattern for
  channel injection; prevents backslash interpretation in channel names
  [Fix] _alert_html_escape: use printf '%s' output (no trailing newline) to
  match _alert_json_escape, _alert_telegram_escape, _alert_slack_escape
  [New] _alert_deliver_email: validate non-empty recipient at function entry
  [New] _alert_slack_post_message: validate payload_file exists before
  processing; matches _alert_slack_upload validation pattern
  [New] Tests for telegram_document missing chat_id, Reply-To in text-sendmail
  fallback, empty email recipient validation, Slack channel JSON escaping,
  Slack payload_file guard, Slack channel backslash preservation (ENVIRON)
  [Change] README: add ALERT_EMAIL_REPLY_TO to environment variables table,
  add _alert_redact_url to API reference, update version badge and test
  counts

alert_lib v1.0.2

• 1.0.2 | Mar 06 2026:
  [Fix] SMTP relay credentials no longer visible in process listing;
  _alert_email_relay uses curl -K config file (chmod 600, cleaned after
  use) instead of --user command-line argument; follows same security
  pattern as _alert_telegram_api
  [Fix] Webhook URLs containing embedded tokens (Slack incoming webhooks,
  Discord webhooks) redacted in _alert_curl_post error messages;
  new _alert_redact_url helper strips token portion from known webhook
  URL patterns before logging to stderr
  [Change] _alert_email_relay adds -s (silent) flag to curl for consistency
  with _alert_curl_post and _alert_telegram_api
  [New] Tests for SMTP config file credential hiding, URL redaction of
  Slack/Discord webhooks, and curl_post error message verification