d22175310a
🛡️ Sentinel: [HIGH] Fix Server-Side Request Forgery in IMAP connections
...
🚨 Severity: HIGH
💡 Vulnerability: User-provided IMAP `host` in `_test_imap_connection` and `pull_inbox` was not validated against private IPs, creating an SSRF risk.
🎯 Impact: Attackers could abuse the endpoints to port-scan or interact with internal/private network services.
🔧 Fix: Integrated `is_private_ip` from `app.utils.network` to block connections resolving to private, loopback, link-local, or reserved IPs.
✅ Verification: Ran `test_imap_tasks.py` and `test_api_imap_accounts.py` successfully. Checked `ruff` output and diffs. Removed all scratch files from the commit.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-03-23 14:45:22 +00:00
0a44b06b6d
Fix command injection vulnerability in subprocess calls.
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-03-21 04:00:05 +00:00
144a90fa73
fix(pdfa): address code review - validate pdfa_format, add S3 comment, add format test
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-03-02 14:01:26 +00:00
a03b3af933
feat(pdfa): add FreeTSA timestamping, per-provider folder overrides, individual upload toggles
...
- Add RFC 3161 timestamping via FreeTSA (PDFA_TIMESTAMP_ENABLED, PDFA_TIMESTAMP_URL)
- Replace PDFA_UPLOAD_TO_PROVIDERS with individual PDFA_UPLOAD_ORIGINAL and PDFA_UPLOAD_PROCESSED
- Add PDFA_UPLOAD_FOLDER setting for per-provider subfolder configuration
- Add GOOGLE_DRIVE_PDFA_FOLDER_ID for Google Drive-specific folder override
- Add folder_override parameter to all 8 folder-using upload tasks
- Add folder_overrides dict parameter to send_to_all_destinations
- Add _compute_pdfa_folder_overrides() and _timestamp_file() helpers
- Expand tests to 26 (timestamping, folder overrides, individual toggles)
- Update docs/ConfigurationGuide.md and .env.demo
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-03-02 13:55:34 +00:00
eea99eb01d
feat(pdfa): add PDF/A archival conversion using ocrmypdf
...
- Add ENABLE_PDFA_CONVERSION, PDFA_FORMAT, PDFA_UPLOAD_TO_PROVIDERS config settings
- Add original_pdfa_path and processed_pdfa_path columns to FileRecord model
- Create Alembic migration 011_add_pdfa_paths
- Create app/tasks/convert_to_pdfa.py Celery task using ocrmypdf + Ghostscript
- Integrate PDF/A conversion into finalize_document_storage pipeline
- Add comprehensive unit tests (15 tests)
- Update .env.demo and docs/ConfigurationGuide.md
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-03-02 13:35:13 +00:00
google-labs-jules[bot]