From 4772902ed2b5017da4f093649d081a14203ae119 Mon Sep 17 00:00:00 2001
From: hygienic-books <hygienic-books@tentic.net>
Date: Mon, 17 Mar 2025 23:01:41 +0100
Subject: [PATCH] fix(script): Add event allow-list

---
 notify_signal_about_traccar_events.sh         | 14 ++++++++-----
 ...ignal_about_traccar_events.sh.conf.example | 20 ++++++++++++++++++-
 2 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/notify_signal_about_traccar_events.sh b/notify_signal_about_traccar_events.sh
index be20546..717a09e 100755
--- a/notify_signal_about_traccar_events.sh
+++ b/notify_signal_about_traccar_events.sh
@@ -16,11 +16,12 @@ function load_config() {
         source "${conf_file_resolved_abs_path}"
     fi
     # Optional, will use default values if not given by user
+    : "${allow_list_events:='^(deviceOnline|deviceUnknown|geofenceEnter|geofenceExit)$'}"
+    : "${message_event_type_not_allowed:='Event "%s" not allowed. Nothing to do.\n'}"
     : "${message_geofence_enter:='%s entered geofence %s.'}"
     : "${message_geofence_exit:='%s left geofence %s.'}"
     : "${message_device_online:='On %s Traccar Client app is now active.'}"
     : "${message_device_unknown:='On %s Traccar Client app has not checked in for 10 minutes, the app is likely off now.'}"
-    : "${message_device_offline:='On %s Traccar Client app is now off.'}"
     : "${message_device_unhandled:='For %s we do not want to send a message to Signal. Nothing to do.\n'}"
     : "${message_event_other:='%s triggered event "%s" in Traccar server.'}"
     : "${allow_unique_device_ids_posix_ere:=''}"
@@ -37,6 +38,13 @@ function get_event_data() {
 
     device_name="$(<<<"${payload}" jq --raw-output '.device.name')"
     event_type="$(<<<"${payload}" jq --raw-output '.event.type')"
+
+    # Discard event and stop any further action unless event is allow-listed
+    if ! [[ "${event_type}" =~ ${allow_list_events} ]]; then
+        printf -- "${message_event_type_not_allowed}" "${device_name}"
+        exit 0
+    fi
+
     if [[ "${event_type}" = 'geofenceEnter' || "${event_type}" = 'geofenceExit' ]]; then
         battery_level="$(<<<"${payload}" jq --raw-output '.position.attributes.batteryLevel')"
         battery_level="$(echo "${battery_level}"' / 1' | bc)"
@@ -69,10 +77,6 @@ function craft_message() {
             message="${message_device_unknown}"
             message="$(printf -- "${message}" "${device_name}")"
             ;;
-        'deviceOffline')
-            message="${message_device_offline}"
-            message="$(printf -- "${message}" "${device_name}")"
-            ;;
         *)
             message="${message_event_other}"
             message="$(printf -- "${message}" "${device_name}" "${event_type}")"
diff --git a/notify_signal_about_traccar_events.sh.conf.example b/notify_signal_about_traccar_events.sh.conf.example
index cd637f1..6431f3a 100644
--- a/notify_signal_about_traccar_events.sh.conf.example
+++ b/notify_signal_about_traccar_events.sh.conf.example
@@ -1,3 +1,22 @@
+# List of events on which this script will act. This is a Posix Extended
+# Regular Expression (ERE). Most Perl-Compatible Regular Expression
+# (PCRE) syntax works. Most notably lookarounds are unsupported in ERE.
+# Default's '^(deviceOnline|deviceUnknown|geofenceEnter|geofenceExit)$'.
+# Any event not in this list will be discarded. Note that this script
+# only /gracefully/ acts on these four events anyway. You can have it
+# act on any other event as well but in its current state that just
+# triggers the message_event_other Signal message which is decidedly
+# /ungraceful/, its usefulness is limited.
+#
+# For a list of events refer to github.com/traccar/traccar, specifically
+# the 'src/main/java/org/traccar/model/Event.java' file that lists all
+# available event names.
+allow_list_events='^(deviceOnline|deviceUnknown|geofenceEnter|geofenceExit)$'
+
+# If an event comes in that's not in allow_list_events we print this
+# message to stdout and exit.
+message_event_type_not_allowed='Event "%s" not allowed. Nothing to do.\n'
+
 # First positional argument '%s' is Traccar device name, second
 # positional argument '%s' is geofence name, third one is battery level.
 # This cannot be switched around, please word your message accordingly.
@@ -8,7 +27,6 @@ message_geofence_exit='%s left geofence %s.\\n\\nBattery level %s%%.'
 # Argument '%s' is Traccar device name
 message_device_online='On %s Traccar Client app is now active.'
 message_device_unknown='On %s Traccar Client app has not checked in for 10 minutes, the app is likely off now.'
-message_device_offline='On %s Traccar Client app is now off.'
 
 # Argument '%s' is Traccar device name but this one unlike the three
 # message strings before is used as stdout log output when the device ID