gitea-admin/gh-christianlouis-docuelevate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
546 Commits 28 Branches 0 Tags
3103ebed2b5febbebf41b1b1f31e11b2104f9a72
Commit Graph

12 Commits

Author SHA1 Message Date
copilot-swe-agent[bot] 9a89f70cf4 fix: change SFTP host key verification default to secure (False) 
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-02-10 15:39:23 +00:00
copilot-swe-agent[bot] 956f0c0c2a refactor: change security headers default to disabled 
Security headers are now disabled by default since most deployments use a reverse proxy (Traefik, Nginx) that already adds these headers. Enable with SECURITY_HEADERS_ENABLED=true for direct deployments.

Changes:
- Set security_headers_enabled default to False in app/config.py
- Update all documentation to reflect new default
- Comment out examples in .env.demo (now showing disabled state)
- Update SECURITY_AUDIT.md to reflect reverse proxy as default deployment
- Tests still pass (3 passed, 8 skipped as expected with headers disabled)

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-02-10 14:22:47 +00:00
copilot-swe-agent[bot] 20a0e43a11 docs: address code review comments 
- Fix test count in SECURITY_AUDIT.md (11 tests, not 24)
- Add deprecation note for ALLOW-FROM in X-Frame-Options
- Update documentation to recommend CSP frame-ancestors instead

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-02-10 14:10:23 +00:00
copilot-swe-agent[bot] e144fdd50a feat(security): add configurable security headers middleware 
- Add SecurityHeadersMiddleware with HSTS, CSP, X-Frame-Options, X-Content-Type-Options
- Add configuration options in app/config.py
- Integrate middleware into app/main.py
- Add comprehensive tests in tests/test_security_headers.py
- Update .env.demo with security header examples
- Update docs/DeploymentGuide.md with security headers section and Traefik/Nginx examples
- Update docs/ConfigurationGuide.md with detailed configuration reference
- Update SECURITY_AUDIT.md to mark security headers implementation complete

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-02-10 14:05:19 +00:00
copilot-swe-agent[bot] f4b4ab0328 docs: clarify PDF splitting is page-based, not byte-based 
- Add prominent documentation that splitting uses page boundaries
- Update docstring with IMPORTANT note about page-level splitting
- Add test to validate split PDFs are valid and readable
- Update ConfigurationGuide.md to emphasize page-based approach
- Update SECURITY_AUDIT.md with implementation details
- Ensures users understand no risk of corrupted PDFs

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-02-10 13:51:24 +00:00
copilot-swe-agent[bot] 9ad32e40e6 feat(security): add configurable file upload size limits with optional splitting 
- Add MAX_UPLOAD_SIZE config (default 1GB) to prevent resource exhaustion
- Add MAX_SINGLE_FILE_SIZE config for optional PDF file splitting
- Implement automatic PDF splitting when files exceed single file limit
- Update upload endpoint to use configured limits instead of hardcoded 500MB
- Add comprehensive tests for upload limits and file splitting
- Document configuration in ConfigurationGuide.md and SECURITY_AUDIT.md
- Reference SECURITY_AUDIT.md in error messages for user guidance

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-02-10 10:51:30 +00:00
copilot-swe-agent[bot] 489aa67a13 fix(security): remediate path traversal vulnerabilities in file operations 
- Fix critical vulnerability: sanitize GPT metadata filename before use
- Fix insecure string-based path validation with pathlib methods
- Add validation for GPT-extracted filenames
- Add comprehensive security test suite (24 tests)
- Document all findings in SECURITY_AUDIT.md

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-02-10 10:26:42 +00:00
Christian Krakau-Louis 8ac16420b2 Update SECURITY_AUDIT.md with the latest audit results. 2026-02-09 22:08:35 +01:00
copilot-swe-agent[bot] b3b74adb45 chore: remove dead files and duplicate workflows 
- Delete build-setup.sh (empty shell script)
- Delete docker-build.sh (empty shell script)
- Delete .github/workflows/codeql.yaml (duplicate, keeping codeql.yml)
- Delete issues/ directory (3 markdown files)
- Update SECURITY_AUDIT.md to remove completed task about consolidating CodeQL workflows
- Update docs/archive/ANALYSIS_SUMMARY.md to reference codeql.yml instead of codeql.yaml

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-02-08 17:02:11 +00:00
copilot-swe-agent[bot] 7fc2703d90 Increase HTTP request timeout to 120s for large file processing (up to 1GB PDFs) 
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-02-07 19:39:57 +00:00
copilot-swe-agent[bot] 755ef8a2e5 Add Bandit to CI pipeline and update security audit documentation 
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-02-07 19:38:47 +00:00
copilot-swe-agent[bot] f0f48b39a9 Add security fixes, testing infrastructure, and CI/CD improvements 
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-02-06 21:55:19 +00:00