Validate webhook URL for Slack and Discord (#11565)

* Validate webhook URL for Slack and Discord

* Update discord.py

medusa/notifiers/discord.py

@@ -4,6 +4,7 @@
 from __future__ import unicode_literals
 
 import logging
+import re
 from builtins import object
 
 from medusa import app
@@ -33,9 +34,20 @@ class Notifier(object):
     https://discordapp.com
     """
 
+    WEBHOOK_PATTERN = r'https://discord\.com/api/webhooks/.*'
+
+    def is_valid_webhook(self, url):
+        """Determine if a given webhook URL matches the predefined pattern."""
+        return re.match(self.WEBHOOK_PATTERN, url) is not None
+
     def _send_discord_msg(self, title, msg, webhook=None, tts=None, override_avatar=None):
         """Collect the parameters and send the message to the discord webhook."""
         webhook = app.DISCORD_WEBHOOK if webhook is None else webhook
+        if not self.is_valid_webhook(webhook):
+            msg = f'The webhook URL ({webhook}) you provided is not valid'
+            log.warning(msg)
+            return False, msg
+
         tts = app.DISCORD_TTS if tts is None else tts
         override_avatar = app.DISCORD_OVERRIDE_AVATAR if override_avatar is None else override_avatar
 
@@ -79,7 +91,7 @@ def _send_discord_msg(self, title, msg, webhook=None, tts=None, override_avatar=
                 else:
                     message = http_status_code.get(error.response.status_code, message)
         except Exception as error:
-            message = 'Error while sending Discord message: {0} '.format(error)
+            message = 'Error while sending Discord message: {0}'.format(error)
         finally:
             log.info(message)
         return success, message

medusa/notifiers/slack.py

@@ -5,6 +5,7 @@
 
 import json
 import logging
+import re
 from builtins import object
 
 from medusa import app, common
@@ -19,6 +20,8 @@
 class Notifier(object):
     """Slack notifier class."""
 
+    WEBHOOK_PATTERN = r'https://hooks\.slack\.com/services/.*'
+
     def notify_snatch(self, title, message, **kwargs):
         """
         Send a notification to a Slack channel when an episode is snatched.
@@ -85,12 +88,19 @@ def test_notify(self, slack_webhook):
         """
         return self._notify_slack('This is a test notification from Medusa', force=True, webhook=slack_webhook)
 
+    def is_valid_webhook(self, url):
+        """Determine if a given webhook URL matches the predefined pattern."""
+        return re.match(self.WEBHOOK_PATTERN, url) is not None
+
     def _send_slack(self, message=None, webhook=None):
         """Send the http request using the Slack webhook."""
         webhook = webhook or app.SLACK_WEBHOOK
+        if not self.is_valid_webhook(webhook):
+            log.warning(f'The webhook URL ({webhook}) you provided is not valid')
+            return False
 
         log.info('Sending slack message: {message}', {'message': message})
-        log.info('Sending slack message  to url: {url}', {'url': webhook})
+        log.info('Sending slack message to url: {url}', {'url': webhook})
 
         headers = {'Content-Type': 'application/json'}
         data = {