🚨 Severity: HIGH
💡 Vulnerability: User-provided IMAP `host` in `_test_imap_connection` and `pull_inbox` was not validated against private IPs, creating an SSRF risk.
🎯 Impact: Attackers could abuse the endpoints to port-scan or interact with internal/private network services.
🔧 Fix: Integrated `is_private_ip` from `app.utils.network` to block connections resolving to private, loopback, link-local, or reserved IPs.
✅ Verification: Ran `test_imap_tasks.py` and `test_api_imap_accounts.py` successfully. Checked `ruff` output and diffs. Removed all scratch files from the commit.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Added tests for POST /api/dropbox/list-folders (7 tests) and
POST /api/onedrive/list-folders (7 tests) covering success, subfolder
navigation, empty directories, auth errors, API errors, path
normalization, and alphabetical sorting.
Added view tests for system credentials toggle visibility in Dropbox
setup wizard.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
E) Wizard DB persistence + worker sync
- app/api/dropbox.py: save-settings persists to DB (primary); .env write
is now best-effort (no 500 on missing file); notify_settings_updated()
called; update-settings already done in previous commit
- app/api/google_drive.py: update-settings + save-settings both persist
to DB and call notify_settings_updated(); .env write remains best-effort
- app/api/onedrive.py: save-settings + update-settings persist to DB +
notify; test-token auto-refresh path persists rotated token via
SessionLocal + notifies; .env write is best-effort throughout
- app/views/wizard.py: setup-wizard POST calls notify_settings_updated()
when settings are saved; GET pre-fills fields from DB > ENV > default
with a source badge; new GET /setup/undo-skip route removes skip marker
F) ENV Exporter
- app/utils/settings_service.py: get_settings_for_export(db, source)
supports source=db (DB-only) and source=effective (full runtime config)
- app/api/settings.py: GET /api/settings/export-env admin-only endpoint
returns downloadable .env file; source= query param selects scope
- frontend/templates/settings.html: Export .env dropdown (DB / effective)
+ Setup Wizard button added alongside existing Audit Log button
G) Setup Wizard improvements
- frontend/templates/setup_wizard.html: inputs pre-filled with
current_value; DB/ENV/DEFAULT source badges; undo-skip messaging
- app/views/wizard.py: passes setup_skipped flag to template
Tests
- tests/test_wizard_db_persist.py: 28 tests across 7 classes covering
wizard DB persistence, undo-skip, ENV exporter service + endpoint
- tests/test_api_dropbox.py: updated two tests to match new best-effort
.env behavior (was: assert 500; now: assert 200)
- tests/test_api_onedrive_comprehensive.py: same for two OneDrive tests;
fixed settings singleton pollution by adding @patch("app.api.*.settings")
to all new wizard tests that call save/update endpoints
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Improve PDF test to use valid minimal PDF structure
- Clarify test intent for settings mock behavior
- Make assertions more specific where possible
- Fix singular/plural form test for time formatting
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
copilot-swe-agent[bot]