🚨 Severity: HIGH
💡 Vulnerability: User-provided IMAP `host` in `_test_imap_connection` and `pull_inbox` was not validated against private IPs, creating an SSRF risk.
🎯 Impact: Attackers could abuse the endpoints to port-scan or interact with internal/private network services.
🔧 Fix: Integrated `is_private_ip` from `app.utils.network` to block connections resolving to private, loopback, link-local, or reserved IPs.
✅ Verification: Ran `test_imap_tasks.py` and `test_api_imap_accounts.py` successfully. Checked `ruff` output and diffs. Removed all scratch files from the commit.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Add `from app.tasks.upload_to_user_integration import upload_to_user_integration`
to app/celery_worker.py — fixes TestCeleryWorkerConfig test that enforces
every tasks/ module is registered with Celery.
- Add tests/test_upload_handlers.py with 43 unit tests covering all 11
per-type upload handler functions (_upload_dropbox, _upload_s3,
_upload_google_drive, _upload_onedrive, _upload_webdav, _upload_nextcloud,
_upload_ftp, _upload_sftp, _upload_paperless, _upload_email, _upload_rclone)
plus 2 additional finalize_document_storage branch tests. All external
libraries (dropbox, boto3, msal, paramiko, smtplib, subprocess, requests)
are mocked so tests are hermetic and fast. Coverage on changed files:
upload_to_user_integration.py 94.71%, finalize_document_storage.py 95.51%
(both well above the 70% Codecov diff threshold).
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
google-labs-jules[bot]