From f078e006c1b39c71c33458ad86bc96d686bc2c72 Mon Sep 17 00:00:00 2001
From: Nico <47644445+nicotsx@users.noreply.github.com>
Date: Sat, 25 Apr 2026 09:24:05 +0200
Subject: [PATCH] fix(notifications): encode SMTP credentials in Shoutrrr URLs
 (#831)

Closes #829
---
 .../__tests__/notification-builders.test.ts       | 15 +++++++++++++++
 .../modules/notifications/builders/email.ts       |  6 +++---
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/app/server/modules/notifications/__tests__/notification-builders.test.ts b/app/server/modules/notifications/__tests__/notification-builders.test.ts
index 58bc74ea..b44be76d 100644
--- a/app/server/modules/notifications/__tests__/notification-builders.test.ts
+++ b/app/server/modules/notifications/__tests__/notification-builders.test.ts
@@ -39,6 +39,21 @@ describe("notification shoutrrr URL builders", () => {
 		).toBe(
 			"smtp://user%20name:p%40ss%20word@smtp.example.com:465/?from=alerts%2Bteam%40example.com&fromname=Ops+Team&to=ops%40example.com&starttls=no",
 		);
+
+		expect(
+			buildEmailShoutrrrUrl({
+				type: "email",
+				smtpHost: "smtp.example.com",
+				smtpPort: 465,
+				username: "user%name+tag",
+				password: "pa%ss+word",
+				from: "alerts@example.com",
+				to: ["ops@example.com"],
+				useTLS: false,
+			}),
+		).toBe(
+			"smtp://user%25name%2Btag:pa%25ss%2Bword@smtp.example.com:465/?from=alerts%40example.com&to=ops%40example.com&starttls=no",
+		);
 	});
 
 	test("builds discord URLs and rejects invalid webhook formats", () => {
diff --git a/app/server/modules/notifications/builders/email.ts b/app/server/modules/notifications/builders/email.ts
index 73228fcc..ebfcce51 100644
--- a/app/server/modules/notifications/builders/email.ts
+++ b/app/server/modules/notifications/builders/email.ts
@@ -7,9 +7,9 @@ export const buildEmailShoutrrrUrl = (config: Extract<NotificationConfig, { type
 	shoutrrrUrl.port = String(config.smtpPort);
 	shoutrrrUrl.pathname = "/";
 
+	let auth = "";
 	if (config.username && config.password) {
-		shoutrrrUrl.username = config.username;
-		shoutrrrUrl.password = config.password;
+		auth = `${encodeURIComponent(config.username)}:${encodeURIComponent(config.password)}@`;
 	}
 
 	shoutrrrUrl.searchParams.set("from", config.from);
@@ -19,5 +19,5 @@ export const buildEmailShoutrrrUrl = (config: Extract<NotificationConfig, { type
 	shoutrrrUrl.searchParams.set("to", config.to.join(","));
 	shoutrrrUrl.searchParams.set("starttls", config.useTLS ? "yes" : "no");
 
-	return shoutrrrUrl.toString();
+	return shoutrrrUrl.toString().replace("smtp://", `smtp://${auth}`);
 };