Add Pushover notifications support (#3693)

[sickwell6988]

Originally requested in #3693

Tested and verified

Tested in Docker

Performed tests agains the new feature, by defining setting in

• config.json
• environment variables
• new Pushover token UI field

Pushover API token UI field > config.json || environment variables

[cursor]

Stale comment

Security review: PR #3976 (Pushover notifications)

Reviewed the added Pushover alert path end-to-end (project settings → task runner → pushover.tmpl → Pushover API).

Outcome: 2 medium-severity issues found in new code.

Severity	Issue	Location
Medium	Pushover API token readable by any project member (not just project admins)	db/Project.go
Medium	JSON injection via unescaped task/template fields can override Pushover API parameters	services/tasks/templates/pushover.tmpl

No authn/authz bypass, SSRF, SQL injection, or new dependency supply-chain concerns identified in this diff.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Severity: Medium — JSON injection / alert manipulation

This template builds JSON with text/template and no escaping. {{ .Task.Desc }} is populated from Task.Message, which task starters can set via POST /api/project/{id}/tasks (CanRunProjectTasks). Template name and author are also attacker-influenced.

Attack path: start a task with a crafted message such as x"}, "user": "<attacker_pushover_key>", "priority": 2, "x": ". When the alert fires, injected keys can override Pushover API fields (recipient user, priority, etc.) because duplicate JSON keys are commonly last-wins.

Impact: redirect operational alerts to an attacker-controlled Pushover account (information disclosure) or manipulate notification metadata; phishing via injected url is also possible depending on parser behavior.

[cursor]

Security review: PR #3976 (Pushover notifications)

Re-reviewed after latest changes (synchronize).

Outcome: 1 medium-severity issue in new code. Prior per-project credential disclosure finding is resolved — Pushover credentials now come only from global config (util.Config), not project API fields.

Severity	Issue	Location
Medium	JSON injection via unescaped task fields can override Pushover API parameters (recipient user, url, etc.)	services/tasks/templates/pushover.tmpl

Resolved since last review: Per-project alert_pushover_token exposure (db/Project.go) no longer present in this PR.

No authn/authz bypass, SSRF, SQL injection, or meaningful supply-chain change identified (package-lock.json is a formatting-only churn).

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Severity: Medium — JSON injection / alert hijacking

This template builds JSON with text/template and no escaping. {{ .Task.Desc }} is populated from Task.Message, which task starters supply via POST /api/project/{id}/tasks (requires CanRunProjectTasks). {{ .Author }} and template {{ .Name }} are also attacker-influenced.

Attack path: start a task with a crafted message such as x"}, "user": "<attacker_pushover_key>", "priority": 2, "x": ". When the alert fires, injected keys appear after the legitimate user field; duplicate-key parsers (including typical JSON decoders) are last-wins, so the notification is redirected to the attacker's Pushover account using the server's application token.

Impact: operational alert hijacking (information disclosure) and possible phishing via injected url/title fields.

Fix: build the request with encoding/json (or at minimum json template func escaping) instead of hand-assembled JSON strings.