mirror of
https://github.com/acmesh-official/acme.sh.git
synced 2026-08-18 15:13:29 +08:00
notify: clear inherited _H1.._H5 before running each notify hook
The dns/deploy hooks export _H1.._H5 in the main process, and the notify hooks run in a subshell that inherits them. A hook that does not overwrite every slot (ntfy without NTFY_TOKEN, slack, telegram, etc.) sent the stale headers with its request, leaking another service's Authorization credentials to the notify endpoint. https://github.com/acmesh-official/acme.sh/issues/6801
This commit is contained in:
8
acme.sh
8
acme.sh
@@ -7765,6 +7765,14 @@ _send_notify() {
|
||||
continue
|
||||
fi
|
||||
if ! (
|
||||
# The dns/deploy hooks export _H1.._H5 in the main process, so the
|
||||
# values are inherited here. Clear them: a stale Authorization header
|
||||
# from another service must not leak into the notify request.
|
||||
export _H1=""
|
||||
export _H2=""
|
||||
export _H3=""
|
||||
export _H4=""
|
||||
export _H5=""
|
||||
if ! . "$_n_hook_file"; then
|
||||
_err "Error loading file $_n_hook_file. Please check your API file and try again."
|
||||
return 1
|
||||
|
||||
Reference in New Issue
Block a user