ec44cb082e
Initial plan
2026-02-10 13:59:46 +00:00
c58f8e4b3a
Merge pull request #222 from christianlouis/copilot/add-file-upload-size-limits
...
docs: clarify PDF splitting uses page boundaries, not byte offsets
2026-02-10 14:59:02 +01:00
f4b4ab0328
docs: clarify PDF splitting is page-based, not byte-based
...
- Add prominent documentation that splitting uses page boundaries
- Update docstring with IMPORTANT note about page-level splitting
- Add test to validate split PDFs are valid and readable
- Update ConfigurationGuide.md to emphasize page-based approach
- Update SECURITY_AUDIT.md with implementation details
- Ensures users understand no risk of corrupted PDFs
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-10 13:51:24 +00:00
dec7afe712
refactor: extract condition to variable for readability
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-10 11:01:56 +00:00
03222c5ef1
refactor: improve file splitting performance and code quality
...
- Use BytesIO for size checking instead of temporary disk writes (major performance improvement)
- Add constant and comment for PDF overhead multiplier in tests
- Address code review feedback
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-10 10:59:39 +00:00
ee43687eaa
test: fix formatting and linting issues in file upload tests
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-10 10:56:54 +00:00
9ad32e40e6
feat(security): add configurable file upload size limits with optional splitting
...
- Add MAX_UPLOAD_SIZE config (default 1GB) to prevent resource exhaustion
- Add MAX_SINGLE_FILE_SIZE config for optional PDF file splitting
- Implement automatic PDF splitting when files exceed single file limit
- Update upload endpoint to use configured limits instead of hardcoded 500MB
- Add comprehensive tests for upload limits and file splitting
- Document configuration in ConfigurationGuide.md and SECURITY_AUDIT.md
- Reference SECURITY_AUDIT.md in error messages for user guidance
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-10 10:51:30 +00:00
bbffb32da4
Initial plan
2026-02-10 10:46:32 +00:00
19a0e71ab1
Merge pull request #221 from christianlouis/copilot/review-file-path-operations
...
Security: Remediate path traversal vulnerabilities in file operations
2026-02-10 11:45:41 +01:00
1937ea84cb
docs: add detailed path traversal security audit report
...
- Create comprehensive audit documentation
- Document all vulnerabilities, fixes, and testing
- Include security recommendations for future development
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-10 10:30:26 +00:00
a3d0af2efc
fix(security): address code review feedback on validation logic
...
- Improve comment documentation for defense-in-depth validation
- Fix test assertion to properly validate basename sanitization
- Note regex pattern duplication for future refactoring
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-10 10:28:39 +00:00
489aa67a13
fix(security): remediate path traversal vulnerabilities in file operations
...
- Fix critical vulnerability: sanitize GPT metadata filename before use
- Fix insecure string-based path validation with pathlib methods
- Add validation for GPT-extracted filenames
- Add comprehensive security test suite (24 tests)
- Document all findings in SECURITY_AUDIT.md
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-10 10:26:42 +00:00
94c05d2b29
Initial plan
2026-02-10 10:21:09 +00:00
b3be69802d
Merge pull request #176 from christianlouis/copilot/add-auth-encryption-tests
...
test: add comprehensive auth and encryption test coverage
2026-02-09 22:32:39 +01:00
42cac76c0e
style: format test files with black and isort, remove unused imports
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 21:19:41 +00:00
acb8951dd9
test: expand auth and encryption test coverage with 299 new test lines
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 21:16:55 +00:00
91755ee5e6
Initial plan
2026-02-09 21:11:34 +00:00
2650c39c46
Merge pull request #166 from christianlouis/copilot/convert-unittest-to-pytest
...
test: convert unittest-style tests to pytest
2026-02-09 22:11:04 +01:00
bc7919ffba
Merge pull request #167 from christianlouis/copilot/fix-uncontrolled-data-alert
...
Harden filename sanitization against path traversal attacks
2026-02-09 22:10:16 +01:00
8ac16420b2
Update SECURITY_AUDIT.md with the latest audit results.
2026-02-09 22:08:35 +01:00
3d2b21b3c8
style: fix linting issues (whitespace and formatting)
...
- Remove trailing whitespace from blank lines
- Apply black formatting to test file
- All tests still pass
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 21:05:44 +00:00
43b512fee8
refactor(security): improve sanitization logic and tests based on code review
...
- Change consecutive dots regex to simple replace for better precision
- Update tests to verify exact sanitized output
- Fix docstring syntax warning with raw string
- Add detailed comments explaining sanitization behavior
- All 43 tests pass (21 file upload + 22 filename utils)
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 21:04:03 +00:00
2bcd774d6d
fix(security): enhance path traversal protection in file uploads
...
- Import and use sanitize_filename utility in ui_upload endpoint
- Enhance sanitize_filename to handle Windows-style paths (backslashes)
- Add protection against path traversal patterns (..)
- Replace all path separators with underscores
- Add comprehensive security tests for Windows-style paths and mixed separators
- All existing tests pass with improved security
This addresses the "Uncontrolled data used in path expression" code scanning alert
by ensuring all user-provided filenames are properly sanitized before being used
in any file operations or stored in the database.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 21:00:51 +00:00
de0f784879
test: remove unused import from test_notifications.py
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 20:56:35 +00:00
758e353eed
test: convert unittest-style tests to pytest in test_utils.py and test_notifications.py
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 20:55:53 +00:00
ef484f85a4
Initial plan
2026-02-09 20:53:50 +00:00
1b3c72ac67
Initial plan
2026-02-09 20:51:51 +00:00
e8f4ba8373
Merge pull request #163 from christianlouis/copilot/refactor-config-validator-module
...
refactor: split config_validator into modular package structure
2026-02-09 17:38:53 +01:00
4552931293
Initial plan
2026-02-09 16:05:12 +00:00
4b145d0280
Merge pull request #162 from christianlouis/copilot/refactor-get-db-module
...
refactor: consolidate get_db into single module
2026-02-09 17:02:30 +01:00
a63983a26c
style: fix formatting and linting issues in conftest.py
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 15:38:31 +00:00
98cf9e0e0b
refactor: consolidate get_db into single module
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 15:37:23 +00:00
cd6fd95d50
Initial plan
2026-02-09 15:31:43 +00:00
0c85dbffdd
Merge pull request #158 from christianlouis/copilot/remove-duplicate-utils-and-license-routes
...
refactor: remove duplicate utils.py and dead license_routes
2026-02-09 16:17:31 +01:00
2a7587f8bb
docs: update references to deleted app/utils.py file
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 15:14:40 +00:00
546db7eff9
refactor: remove duplicate utils.py, dead license_routes, and pytest.ini
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 15:11:26 +00:00
b8c7e12d22
Initial plan
2026-02-09 15:02:42 +00:00
506bb25ee1
Merge pull request #157 from christianlouis/copilot/increase-test-coverage-60
...
test: increase test coverage from 45% to 60%
2026-02-09 14:56:41 +01:00
285454b439
fix: address CodeQL url substring sanitization alert in test
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 12:17:47 +00:00
50910da3e0
test: add final coverage tests to exceed 60% threshold
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 12:15:07 +00:00
c3bfb26c73
test: add comprehensive tests across modules to increase coverage above 60%
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-09 11:57:09 +00:00
d6e57c8b47
Initial plan
2026-02-09 11:28:24 +00:00
317bec2e11
Merge pull request #153 from christianlouis/copilot/improve-codecov-test-coverage
...
test: improve code coverage from 45% to 48% and document roadmap to 60%
2026-02-08 21:53:24 +01:00
1fc0b914e3
docs: update TODO_TESTS.md with final coverage numbers
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-08 19:04:51 +00:00
5f0bed555d
test: add comprehensive tests for oauth_helper and notification utilities
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-08 19:04:30 +00:00
ee2a3390fd
test: add tests for encryption, uptime_kuma, filename_utils, logging, and celery_worker
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-08 18:54:31 +00:00
2846763fdf
Initial plan
2026-02-08 18:35:44 +00:00
146d87cb8c
Merge pull request #151 from christianlouis/copilot/fix-ci-test-coverage
...
Fix Black formatting failures in CI
2026-02-08 19:29:21 +01:00
bb155501b4
fix(tasks): apply Black formatting to extract_metadata_with_gpt.py and rotate_pdf_pages.py
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-08 18:21:45 +00:00
7ea933c9e6
Initial plan
2026-02-08 18:17:54 +00:00
copilot-swe-agent[bot]