Test webhook notification

[hugbubby]

Adds a webhook notification for the new stokc reconciliation API

[zeropath-ai-demo]

Hardcoded Secret in Slack Webhook URL (Severity: MEDIUM)

The Slack incoming webhook URL is hardcoded in src/backend/InvenTree/stock/notifications.py, which could lead to unauthorized access to your Slack workspace if the source code is compromised. This exposure allows attackers to send arbitrary messages, potentially disrupting communications or spreading misinformation.
_{View details in ZeroPath}

Automatic patch generation was not possible for this finding.

_{View reasoning}

[hugbubby]

What could a person do with this slack webhook URL?

[zeropath-ai-demo]

A Slack incoming webhook URL is essentially a write-only credential. Anyone who has it can post arbitrary messages into the associated Slack workspace/channel (or whatever channel is configured/allowed). Typical impacts:

• Spam/abuse: Send unlimited messages, mention users/teams, flood channels.
• Phishing/social engineering: Post links or instructions that appear to come from a trusted integration.
• Operational disruption: Trigger alerts/noise, hide real alerts, or desensitize responders.

It doesn’t grant read access or broader Slack API permissions, but it’s still sensitive because it lets untrusted parties inject content into your Slack. Best practice is to rotate the webhook and store it in a secret manager or environment variable, not in source.

[hugbubby]

Hmm, in this case, go ahead and mark the issue as an accepted risk, explaining that it's only going to write to the one channel.

[zeropath-ai-demo]

I can’t set ACCEPTED_RISK via the current workflow API (supported statuses are PENDING_REVIEW, REVIEWING, PATCHING, RESOLVED, BACKLOG).

Do you want me to:

• move it to BACKLOG with an accepted-risk rationale, or
• mark it RESOLVED with your note?

If you prefer another action (e.g., add rationale without status change), let me know.

[hugbubby]

Yeah, put it in backlog.

[zeropath-ai-demo]

Done — moved issue 3dd7f87b-042f-4d9e-ab7e-bd60b3c64e96 to BACKLOG.

If you want, I can also add a remediation note (e.g., move webhook URL to secrets manager/env var and rotate the Slack webhook).

[zeropath-ai-demo]

🟡 Security issue(s) detected below the blocking threshold. Reviewed everything up to 30fe2a9.

The following issues were found:

• Issue 1: Hardcoded Secret (HS)

  • Location: src/backend/InvenTree/stock/notifications.py:10
  • Score: MEDIUM (54.0)
  • Description: Slack incoming webhook URL is hardcoded in the source code, exposing the secret and allowing anyone with access to the repository to send arbitrary messages to your Slack workspace.
  • Link to UI: https://demo.branch.zeropath.com/app/issues/3dd7f87b-042f-4d9e-ab7e-bd60b3c64e96 (Issue 1, id: 3dd7f87b-042f-4d9e-ab7e-bd60b3c64e96)

Security Overview

• 🔎 Scanned files: 3 changed file(s)
• 🔗 Scan Link: https://demo.branch.zeropath.com/app/repositories/285544ff-dcc3-4a92-a88b-e6ba0ffd09be?scanId=ce226d7b-8fb5-4d36-827c-7ac9df8e2482&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type

Relevant files

Enhancement

► src/backend/InvenTree/stock/api.py     Implement StockReconcile API endpoint     Add URL mapping for stock reconciliation ► src/backend/InvenTree/stock/notifications.py     Implement Slack notification for stock reconciliation completion     Add helper function for sending Slack messages ► src/backend/InvenTree/stock/serializers.py     Create StockReconciliationItemSerializer     Create StockReconciliationSerializer for stock reconciliation     Implement validation for stock reconciliation items     Implement save method for stock reconciliation to adjust quantities and log events