@karmanyaahm0Did someone say push notifications in the FOSS F-Droid version of Nextcloud?
Edit to clarify: [email protected] has been working on a version of Nextcloud that supports UnifiedPush. Originally, we thought it would need a gateway (a server that converts between push formats) to function. However, reading through the Nextcloud code, I realized that they don't have any URL normalization, they just append "/notification" to the provided URL (caused the need for a gateway in the first place). So, I realized, we could just add a "#" to the end of our push URL, like ntfy.sh/upABCDEFGH?up=1#, then, Nextcloud will send notifications to ntfy.sh/upABCDEFGH?up=1#/notification, which is effectively our original URL! (Stuff after # is ignored).
One of the most useful (benign) injection attacks I've ever come up with.
Boom! No gateway Nextcloud UnifiedPush: github.com/nr23730/nextcloud-android/pull/1/files
@linus0Our checked bag finally came with the best souvenir: an authentic, used cow bell!
