a3d0af2efc
fix(security): address code review feedback on validation logic
...
- Improve comment documentation for defense-in-depth validation
- Fix test assertion to properly validate basename sanitization
- Note regex pattern duplication for future refactoring
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-10 10:28:39 +00:00
489aa67a13
fix(security): remediate path traversal vulnerabilities in file operations
...
- Fix critical vulnerability: sanitize GPT metadata filename before use
- Fix insecure string-based path validation with pathlib methods
- Add validation for GPT-extracted filenames
- Add comprehensive security test suite (24 tests)
- Document all findings in SECURITY_AUDIT.md
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-10 10:26:42 +00:00
94c05d2b29
Initial plan
2026-02-10 10:21:09 +00:00
b3be69802d
Merge pull request #176 from christianlouis/copilot/add-auth-encryption-tests
...
test: add comprehensive auth and encryption test coverage
2026-02-09 22:32:39 +01:00
42cac76c0e
style: format test files with black and isort, remove unused imports
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 21:19:41 +00:00
acb8951dd9
test: expand auth and encryption test coverage with 299 new test lines
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 21:16:55 +00:00
91755ee5e6
Initial plan
2026-02-09 21:11:34 +00:00
2650c39c46
Merge pull request #166 from christianlouis/copilot/convert-unittest-to-pytest
...
test: convert unittest-style tests to pytest
2026-02-09 22:11:04 +01:00
bc7919ffba
Merge pull request #167 from christianlouis/copilot/fix-uncontrolled-data-alert
...
Harden filename sanitization against path traversal attacks
2026-02-09 22:10:16 +01:00
8ac16420b2
Update SECURITY_AUDIT.md with the latest audit results.
2026-02-09 22:08:35 +01:00
3d2b21b3c8
style: fix linting issues (whitespace and formatting)
...
- Remove trailing whitespace from blank lines
- Apply black formatting to test file
- All tests still pass
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 21:05:44 +00:00
43b512fee8
refactor(security): improve sanitization logic and tests based on code review
...
- Change consecutive dots regex to simple replace for better precision
- Update tests to verify exact sanitized output
- Fix docstring syntax warning with raw string
- Add detailed comments explaining sanitization behavior
- All 43 tests pass (21 file upload + 22 filename utils)
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 21:04:03 +00:00
2bcd774d6d
fix(security): enhance path traversal protection in file uploads
...
- Import and use sanitize_filename utility in ui_upload endpoint
- Enhance sanitize_filename to handle Windows-style paths (backslashes)
- Add protection against path traversal patterns (..)
- Replace all path separators with underscores
- Add comprehensive security tests for Windows-style paths and mixed separators
- All existing tests pass with improved security
This addresses the "Uncontrolled data used in path expression" code scanning alert
by ensuring all user-provided filenames are properly sanitized before being used
in any file operations or stored in the database.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 21:00:51 +00:00
de0f784879
test: remove unused import from test_notifications.py
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 20:56:35 +00:00
758e353eed
test: convert unittest-style tests to pytest in test_utils.py and test_notifications.py
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 20:55:53 +00:00
ef484f85a4
Initial plan
2026-02-09 20:53:50 +00:00
1b3c72ac67
Initial plan
2026-02-09 20:51:51 +00:00
e8f4ba8373
Merge pull request #163 from christianlouis/copilot/refactor-config-validator-module
...
refactor: split config_validator into modular package structure
2026-02-09 17:38:53 +01:00
4552931293
Initial plan
2026-02-09 16:05:12 +00:00
4b145d0280
Merge pull request #162 from christianlouis/copilot/refactor-get-db-module
...
refactor: consolidate get_db into single module
2026-02-09 17:02:30 +01:00
a63983a26c
style: fix formatting and linting issues in conftest.py
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 15:38:31 +00:00
98cf9e0e0b
refactor: consolidate get_db into single module
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 15:37:23 +00:00
cd6fd95d50
Initial plan
2026-02-09 15:31:43 +00:00
0c85dbffdd
Merge pull request #158 from christianlouis/copilot/remove-duplicate-utils-and-license-routes
...
refactor: remove duplicate utils.py and dead license_routes
2026-02-09 16:17:31 +01:00
2a7587f8bb
docs: update references to deleted app/utils.py file
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 15:14:40 +00:00
546db7eff9
refactor: remove duplicate utils.py, dead license_routes, and pytest.ini
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 15:11:26 +00:00
b8c7e12d22
Initial plan
2026-02-09 15:02:42 +00:00
506bb25ee1
Merge pull request #157 from christianlouis/copilot/increase-test-coverage-60
...
test: increase test coverage from 45% to 60%
2026-02-09 14:56:41 +01:00
285454b439
fix: address CodeQL url substring sanitization alert in test
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 12:17:47 +00:00
50910da3e0
test: add final coverage tests to exceed 60% threshold
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 12:15:07 +00:00
c3bfb26c73
test: add comprehensive tests across modules to increase coverage above 60%
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 11:57:09 +00:00
d6e57c8b47
Initial plan
2026-02-09 11:28:24 +00:00
317bec2e11
Merge pull request #153 from christianlouis/copilot/improve-codecov-test-coverage
...
test: improve code coverage from 45% to 48% and document roadmap to 60%
2026-02-08 21:53:24 +01:00
1fc0b914e3
docs: update TODO_TESTS.md with final coverage numbers
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-08 19:04:51 +00:00
5f0bed555d
test: add comprehensive tests for oauth_helper and notification utilities
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-08 19:04:30 +00:00
ee2a3390fd
test: add tests for encryption, uptime_kuma, filename_utils, logging, and celery_worker
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-08 18:54:31 +00:00
2846763fdf
Initial plan
2026-02-08 18:35:44 +00:00
146d87cb8c
Merge pull request #151 from christianlouis/copilot/fix-ci-test-coverage
...
Fix Black formatting failures in CI
2026-02-08 19:29:21 +01:00
bb155501b4
fix(tasks): apply Black formatting to extract_metadata_with_gpt.py and rotate_pdf_pages.py
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-08 18:21:45 +00:00
7ea933c9e6
Initial plan
2026-02-08 18:17:54 +00:00
14a5569b05
Merge pull request #149 from christianlouis/copilot/install-codecov-integration
...
Upgrade Codecov integration to v5 and add repository status badges
2026-02-08 19:14:29 +01:00
152f54dade
Merge pull request #148 from christianlouis/copilot/fix-flake8-linter-errors
...
fix: resolve all 1080 Flake8 linter errors across app/ directory
2026-02-08 19:14:01 +01:00
d08040ac4a
style: fix all flake8 linter errors across app/ directory
...
- Run Black formatter and isort on all app/ files
- Remove unused imports (F401) across multiple files
- Add # noqa: F401 for intentional re-exports in celery_worker.py,
tasks/__init__.py, utils.py, frontend.py, views/base.py
- Fix f-strings without placeholders (F541) in azure.py, notification.py,
check_credentials.py, upload_to_onedrive.py, settings.py
- Fix bare except (E722) in upload_to_sftp.py
- Fix block comment format (E265) in models.py
- Move imports to top of file to fix E402 in celery_app.py, celery_worker.py
- Fix line-too-long (E501) by wrapping strings in multiple files
- Remove unused variable (F841) in upload_to_nextcloud.py
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-08 17:42:33 +00:00
b79f61e85f
feat: integrate Codecov v5 with test results and add comprehensive status badges
...
- Update Codecov action from v3 to v5 with token authentication
- Add Codecov test results action v1 for test analytics
- Update pytest to generate JUnit XML for test results
- Add comprehensive status badges to README including:
- Codecov coverage badge
- CI/CD workflow status badges (Tests, Docker CI, CodeQL)
- GitHub release, license, and Python version badges
- Social badges for stars, forks, issues, and PRs
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-08 17:41:41 +00:00
cfe3c5bb23
Initial plan
2026-02-08 17:39:56 +00:00
7827b97e06
Initial plan
2026-02-08 17:33:30 +00:00
75b8dddc7b
Merge pull request #145 from christianlouis/copilot/remove-dead-files-and-workflows
...
chore: remove dead files and duplicate workflows
2026-02-08 18:31:39 +01:00
b3b74adb45
chore: remove dead files and duplicate workflows
...
- Delete build-setup.sh (empty shell script)
- Delete docker-build.sh (empty shell script)
- Delete .github/workflows/codeql.yaml (duplicate, keeping codeql.yml)
- Delete issues/ directory (3 markdown files)
- Update SECURITY_AUDIT.md to remove completed task about consolidating CodeQL workflows
- Update docs/archive/ANALYSIS_SUMMARY.md to reference codeql.yml instead of codeql.yaml
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-08 17:02:11 +00:00
94bd46fabe
Initial plan
2026-02-08 17:00:02 +00:00
5f4ba67f05
Merge pull request #143 from christianlouis/copilot/fix-file-upload-tests
...
fix(tests): Fix Celery task mocking in file upload tests
2026-02-08 17:59:22 +01:00
copilot-swe-agent[bot]