filipnet / checkmk-telegram-notify

Get alerted by Check_MK via Telegram bash script
https://www.filipnet.de/checkmk-telegram-notify
BSD 3-Clause "New" or "Revised" License
58 stars 27 forks source link

Get rid of potential temp file vulnerability #4

Closed ThomasKaiser closed 3 years ago

ThomasKaiser commented 3 years ago

Also address https://github.com/koalaman/shellcheck/wiki/SC2086 in curl call

There's no need for the use of a temporary file at all since all variables are already exported. So better get rid of it since it helps avoiding temp file vulnerabilities and of course also speeds it up a little.

filipnet commented 3 years ago

Hello, these are really useful and valuable additions. I will be glad to add them to the repository. Just tested the code adjustments in my Check_MK instance, works fine too. Thank you very much for your contribution and kind regards

ThomasKaiser commented 3 years ago

BTW: our local script copy now looks like this since I've been experimenting quite a bit with the message templates and ran into encoding troubles:

# transform specific strings to lower case
WHAT="$(tr '[:upper:]' '[:lower:]' <<<"${NOTIFY_WHAT}")"
NOTIFICATIONTYPE="$(tr '[:upper:]' '[:lower:]' <<<"${NOTIFY_NOTIFICATIONTYPE}")"

# message templates for service notification:
SERVICE_MESSAGE="${WHAT} ${NOTIFICATIONTYPE} with ${NOTIFY_HOSTNAME}/${NOTIFY_SERVICEDESC}: ${NOTIFY_PREVIOUSSERVICEHARDSHORTSTATE} -> ${NOTIFY_SERVICESHORTSTATE}

${NOTIFY_SERVICEOUTPUT}

${NOTIFY_SHORTDATETIME}"

# message templates for host notification:
HOST_MESSAGE="${WHAT} ${NOTIFICATIONTYPE} on ${NOTIFY_HOSTNAME} (${NOTIFY_HOSTADDRESS}): ${NOTIFY_PREVIOUSHOSTHARDSHORTSTATE} -> ${NOTIFY_HOSTSHORTSTATE}

${NOTIFY_HOSTOUTPUT}

${NOTIFY_SHORTDATETIME}"

# Create an URL encoded MESSAGE variable to avoid curl problems
if [[ ${NOTIFY_WHAT} == "SERVICE" ]]; then
        MESSAGE="$(perl -ple 's|([^\w=\-:@])|sprintf( "%%%02x", ord( $1))|ge' <<<"${SERVICE_MESSAGE}")"
else
        MESSAGE="$(perl -ple 's|([^\w=\-:@])|sprintf( "%%%02x", ord( $1))|ge' <<<"${HOST_MESSAGE}")"
fi

Still testing (waiting for some switch port CRIT events). If we've finished testing I'll have a look whether I get this URL encoding stuff running with python to minimise external dependencies and might send then another PR.

Cheers