gitea-admin/gh-christianlouis-docuelevate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3,071 Commits 28 Branches 0 Tags
948d118926be042cc3c2a68f58241cc2fcfa23ef
Commit Graph

3071 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
github-actions[bot] 948d118926 docs(changelog): update changelog [skip ci] 2026-05-30 23:50:35 +00:00
Christian Krakau-Louis 4b7b9fd5b6 Add Postgres driver for main deployments 2026-05-31 01:50:07 +02:00
github-actions[bot] 65bd6d71d0 docs(changelog): update changelog [skip ci] 2026-05-30 05:37:26 +00:00
Christian Krakau-Louis 00ec6888c5 🛡️ Sentinel: [HIGH] Fix DOM-based XSS in upload.js (#900) 
* 🛡️ Sentinel: [HIGH] Fix DOM-based XSS in upload.js

Added `_escapeHtml` function to sanitize user-controlled `file.name` before interpolating it into the `row.innerHTML` payload, preventing malicious file names from executing XSS during uploads.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

* Tighten XSS fix PR payload

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Co-authored-by: Christian Krakau-Louis <christian@Christians-Mac-mini-7.local>
 2026-05-30 07:36:58 +02:00
github-actions[bot] 6e4824cb74 chore(release): update build metadata files [skip ci] 2026-05-23 00:38:18 +00:00
semantic-release f1b55de6bc 0.173.2 
Automatically generated by python-semantic-release
 2026-05-23 00:38:15 +00:00
Christian Krakau-Louis 6fc00b8de1 fix: resolve dependabot npm alerts 2026-05-23 02:37:54 +02:00
github-actions[bot] 427db102d8 docs(changelog): update changelog [skip ci] 2026-05-23 00:30:19 +00:00
Christian Krakau-Louis e46f9b9a21 docs: extend product roadmap and milestones 2026-05-23 02:29:46 +02:00
github-actions[bot] 10a6c6255a chore(release): update build metadata files [skip ci] 2026-05-22 20:11:53 +00:00
semantic-release 77d184efd8 0.173.1 
Automatically generated by python-semantic-release
 2026-05-22 20:11:49 +00:00
Christian Krakau-Louis 1ca7f562ef fix: register Evernote task settings 2026-05-22 22:11:26 +02:00
github-actions[bot] 3bccbf883d chore(release): update build metadata files [skip ci] 2026-05-22 10:14:16 +00:00
semantic-release b788b553c0 0.173.0 
Automatically generated by python-semantic-release
 2026-05-22 10:14:12 +00:00
Christian Krakau-Louis 4b46c4baf8 feat(storage): add Evernote destination (#862) 
* feat(storage): add Evernote destination

* style: apply ruff auto-fix

- Auto-formatted code with ruff format
- Applied ruff linting fixes with --fix

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

---------

Co-authored-by: Christian Krakau-Louis <christian@Christians-Mac-mini-7.local>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
 2026-05-22 12:13:46 +02:00
github-actions[bot] 8e744c076d chore(release): update build metadata files [skip ci] 2026-05-17 14:20:12 +00:00
semantic-release cc494c6937 0.172.12 
Automatically generated by python-semantic-release
 2026-05-17 14:20:08 +00:00
Christian Krakau-Louis e2fa96318f 🛡️ Sentinel: [HIGH] Fix SSRF in webhook delivery (#846) 
* fix: validate webhook targets before delivery

* test: cover webhook SSRF validation
 2026-05-17 16:19:41 +02:00
github-actions[bot] 416c3c4758 chore(release): update build metadata files [skip ci] 2026-05-17 14:07:02 +00:00
semantic-release 1c7ef28c5d 0.172.11 
Automatically generated by python-semantic-release
 2026-05-17 14:06:59 +00:00
Christian Krakau-Louis 1a0218799b fix: escape search result template values (#853) 2026-05-17 16:06:39 +02:00
github-actions[bot] 048f28a671 docs(changelog): update changelog [skip ci] 2026-05-17 13:45:16 +00:00
dependabot[bot] b818f07c80 Update setuptools build requirement (#847) 
Co-authored-by: Christian Krakau-Louis <christianlouis@gmail.com>
 2026-05-17 15:44:52 +02:00
github-actions[bot] 06507ed8bf chore(release): update build metadata files [skip ci] 2026-05-17 12:40:24 +00:00
semantic-release 044a9a86d6 0.172.10 
Automatically generated by python-semantic-release
 2026-05-17 12:40:21 +00:00
Christian Krakau-Louis 62d4ca6367 Merge pull request #860 from christianlouis/fix-httpx-asyncclient-syntax-error-15225710494108486471 
Fix SyntaxError caused by duplicate `event_hooks` in `httpx.AsyncClient` instantiation
 2026-05-17 14:39:59 +02:00
Christian Krakau-Louis 871f788f0b fix(url-upload): handle unsafe redirects as client errors 2026-05-17 13:12:55 +02:00
google-labs-jules[bot] 18f5596b01 Fix SyntaxError caused by duplicate event_hooks in httpx.AsyncClient instantiation 
Combined duplicated `event_hooks` keyword arguments into a single dictionary parameter with both `validate_redirect` and `verify_redirect` in `app/api/url_upload.py`. This fixes a `SyntaxError: keyword argument repeated: event_hooks` and ensures that all redirect validations run.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-05-17 03:01:11 +00:00
google-labs-jules[bot] afb8b367ee Fix SyntaxError caused by duplicate event_hooks in httpx.AsyncClient instantiation 
Combined duplicated `event_hooks` keyword arguments into a single dictionary parameter with both `validate_redirect` and `verify_redirect` in `app/api/url_upload.py`. This fixes a `SyntaxError: keyword argument repeated: event_hooks` and ensures that all redirect validations run.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-05-17 02:58:26 +00:00
github-actions[bot] 58b14ae769 docs(changelog): update changelog [skip ci] 2026-04-07 09:35:53 +00:00
Christian Krakau-Louis 23c5bac666 Merge pull request #838 from christianlouis/dependabot/pip/pip-licenses-5.5.5 
Bump pip-licenses from 5.5.1 to 5.5.5
 2026-04-07 11:35:15 +02:00
Christian Krakau-Louis d925dc5cd3 Merge pull request #839 from christianlouis/dependabot/pip/stripe-gte-7.0.0-and-lt-16.0.0 
Update stripe requirement from <15.0.0,>=7.0.0 to >=7.0.0,<16.0.0
 2026-04-07 11:35:04 +02:00
github-actions[bot] b8ddd2f8d2 chore(release): update build metadata files [skip ci] 2026-04-07 09:34:57 +00:00
semantic-release 301ca9d186 0.172.9 
Automatically generated by python-semantic-release
 2026-04-07 09:34:54 +00:00
Christian Krakau-Louis 3bd8a52ea2 Merge pull request #836 from christianlouis/sentinel/fix-s3-ssrf-vulnerability-8738702433604673313 
🛡️ Sentinel: [HIGH] Fix SSRF in S3 connection test endpoint_url
 2026-04-07 11:34:28 +02:00
Christian Krakau-Louis 789e8c6236 Merge pull request #840 from christianlouis/sentinel/ssrf-redirect-bypass-15997970627137004397 
🛡️ Sentinel: [HIGH] Fix SSRF bypass via HTTP redirects in url_upload
 2026-04-07 11:34:11 +02:00
Christian Krakau-Louis a3ea215a1c Merge branch 'main' into sentinel/ssrf-redirect-bypass-15997970627137004397 2026-04-07 11:33:59 +02:00
github-actions[bot] c6e0b80bec docs(changelog): update changelog [skip ci] 2026-04-07 09:33:42 +00:00
Christian Krakau-Louis e86e1b9f13 Merge pull request #845 from christianlouis/sentinel-ssrf-httpx-redirect-fix-3175117423198883580 
🛡️ Sentinel: [HIGH] Fix SSRF bypass via httpx redirects in /process-url
 2026-04-07 11:33:11 +02:00
google-labs-jules[bot] 46a9a30af0 🛡️ Sentinel: [HIGH] Fix SSRF bypass via httpx redirects 
🚨 Severity: HIGH
💡 Vulnerability: The `/process-url` endpoint used `httpx.AsyncClient` with `follow_redirects=True`. While the initial user-provided URL was validated against SSRF protections (blocking private/internal IPs), the client implicitly followed subsequent HTTP redirects without validating their target locations. This allowed an attacker to bypass the initial check by supplying a valid URL that redirected to an internal IP or cloud metadata endpoint.
🎯 Impact: An attacker could potentially access internal network services or cloud metadata endpoints.
🔧 Fix: Implemented an `event_hooks` listener (`validate_redirect`) on the `httpx.AsyncClient` that intercepts responses, extracts the `Location` header, resolves the absolute target URL, and applies the same `validate_url_safety` check before allowing the redirect to be followed.
✅ Verification: Ran `pytest tests/test_url_upload.py`, formatting checks via `ruff format` and linting via `ruff check`.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-04-06 02:55:58 +00:00
google-labs-jules[bot] bdfa3ba1e0 style: sort imports in test_url_upload.py 
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-03-30 03:31:23 +00:00
github-actions[bot] 8295279ec9 style: apply ruff auto-fix 
- Auto-formatted code with ruff format
- Applied ruff linting fixes with --fix

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
 2026-03-30 03:24:20 +00:00
google-labs-jules[bot] 152ee15b06 test: add coverage for url_upload redirect SSRF bypass prevention hook 
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-03-30 03:23:56 +00:00
google-labs-jules[bot] a75e8b9297 🛡️ Sentinel: [HIGH] Fix SSRF bypass via HTTP redirects in url_upload 
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-03-30 03:02:05 +00:00
dependabot[bot] ee664f83fb Update stripe requirement from <15.0.0,>=7.0.0 to >=7.0.0,<16.0.0 
Updates the requirements on [stripe](https://github.com/stripe/stripe-python) to permit the latest version.
- [Release notes](https://github.com/stripe/stripe-python/releases)
- [Changelog](https://github.com/stripe/stripe-python/blob/master/CHANGELOG.md)
- [Commits](https://github.com/stripe/stripe-python/compare/v7.0.0...v15.0.0)

---
updated-dependencies:
- dependency-name: stripe
  dependency-version: 15.0.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-29 23:04:45 +00:00
dependabot[bot] 91ef089aa7 Bump pip-licenses from 5.5.1 to 5.5.5 
Bumps [pip-licenses](https://github.com/raimon49/pip-licenses) from 5.5.1 to 5.5.5.
- [Release notes](https://github.com/raimon49/pip-licenses/releases)
- [Changelog](https://github.com/raimon49/pip-licenses/blob/master/CHANGELOG.md)
- [Commits](https://github.com/raimon49/pip-licenses/compare/v-5.5.1...v-5.5.5)

---
updated-dependencies:
- dependency-name: pip-licenses
  dependency-version: 5.5.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-29 23:04:35 +00:00
google-labs-jules[bot] 925864ddca Close as obsolete 
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-03-27 14:51:28 +00:00
copilot-swe-agent[bot] 57db4c7c82 fix(api): resolve merge conflicts, add type safety for endpoint_url in S3 connection test 
Agent-Logs-Url: https://github.com/christianlouis/DocuElevate/sessions/8a9f717e-a6cb-45f0-8f2a-0e5d1d404657

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-03-27 14:50:51 +00:00
copilot-swe-agent[bot] 35752c9092 fix(api): resolve merge conflicts, add type safety for endpoint_url in S3 connection test 
- Resolve merge conflicts with main (PR #834 also fixed S3 SSRF)
- Add isinstance(endpoint_url, str) type check before urlparse to prevent TypeError on non-string values
- Reject endpoint_url with empty/missing hostname after parsing (malformed URLs like 'https://')
- Keep scheme validation (http/https only) and private IP blocking via is_private_ip()
- Add logger.warning for SSRF block events
- Add regression tests: non-string endpoint_url and empty hostname cases
- Update sentinel.md with consolidated SSRF entry

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-03-27 14:48:52 +00:00
github-actions[bot] 9b9882c4d6 docs(changelog): update changelog [skip ci] 2026-03-27 14:24:59 +00:00