Skip to content

IFTTT trigger sends its webhook with no request timeout #704

Description

@scttbnsn

app/triggers/providers/ifttt/Ifttt.ts:84 calls axios(options) with no timeout, so an unresponsive maker.ifttt.com hangs the notification until Node's socket default gives up.

Its nine axios-calling siblings (Apprise, Discord, Google Chat, Matrix, Mattermost, ntfy, Rocket.Chat, Teams, Telegram) all pass getOutboundHttpTimeoutMs() from app/configuration/runtime-defaults.js. IFTTT is the only one that doesn't.

Not an SSRF issue: the URL is the fixed maker.ifttt.com endpoint, not operator-supplied. It's a liveness gap, and it's the reason SECURITY-ASSURANCE.md has to carry a 'no' in the timeout column for this one path.

Fix: import getOutboundHttpTimeoutMs and add timeout: getOutboundHttpTimeoutMs(), to the options object. Ifttt.test.ts has six expect(axios).toHaveBeenCalledWith({...}) assertions that pin the exact options shape, so all six need the new key. Then flip the IFTTT row in SECURITY-ASSURANCE.md to 'yes' and drop the sentence pointing at this issue.

Found by CodeRabbit while reviewing #702. Kept out of that PR to keep a docs forward-port from growing a code change.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions