@ai-ecoverse/wasi-ntfy 2.32.0-1 → 2.32.0-2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +9 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -74,6 +74,15 @@ command. `NTFY_TITLE`, `NTFY_MESSAGE`, `NTFY_TAGS`, `NTFY_PRIORITY` and
|
|
|
74
74
|
should `unset ${!NTFY_*}` first. Otherwise its `ntfy pub` takes the incoming
|
|
75
75
|
message's topic and fields.
|
|
76
76
|
|
|
77
|
+
The command runs as the user who started `ntfy sub`, with that user's
|
|
78
|
+
privileges, files and environment. Treat everything in a message (`NTFY_*`)
|
|
79
|
+
as untrusted input: anyone who can publish to the topic, or post to a hook
|
|
80
|
+
URL of it, chooses those values. They arrive as data in the environment, so a
|
|
81
|
+
message's `$(…)` or backticks are not run unless the command itself `eval`s
|
|
82
|
+
them. Quote them (`"$NTFY_MESSAGE"`), and never paste them into a shell
|
|
83
|
+
command line. `--token` is not passed to the command's environment;
|
|
84
|
+
`NTFY_TOKEN` is, if you set it in ntfy's own.
|
|
85
|
+
|
|
77
86
|
## The gateway's contract
|
|
78
87
|
|
|
79
88
|
| The gateway | What the client does |
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@ai-ecoverse/wasi-ntfy",
|
|
3
|
-
"version": "2.32.0-
|
|
3
|
+
"version": "2.32.0-2",
|
|
4
4
|
"description": "ntfy 2.32.0 client (ntfy pub, ntfy sub) for slicc WASI preview1 (command ntfy); ntfy.wasm built by homescoop from ntfy v2.32.0 with documented patches",
|
|
5
5
|
"license": "Apache-2.0 OR GPL-2.0-only",
|
|
6
6
|
"repository": {
|