google-labs-jules[bot] 46ab0ad8e2 fix: resolve ssrf verification issue and xss in frontend ...

Resolves a Cross-Site Scripting (XSS) vulnerability in `frontend/templates/files.html` by applying `escapeHtml` and `sanitizeHighlight` functions when injecting search result attributes directly into the DOM via `innerHTML`.

Also fixes an issue in `app/api/url_upload.py` where providing the `event_hooks` argument twice caused a `SyntaxError` (and potentially bypassed security hooks). Both `validate_redirect` and `verify_redirect` hooks are now safely consolidated into a single list for the `httpx.AsyncClient` initialization.

Also updates tests and .gitignore to prevent CI issues.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

2026-05-17 14:32:51 +00:00

..

__init__.py

fix: restore all code deleted/truncated by d2217531 Jules SSRF commit

2026-03-23 23:52:39 +00:00

admin_users.py

fix(auth): activate account on password reset and fix is_active check order

2026-03-08 12:07:25 +00:00

api_tokens.py

fix: restore all code deleted/truncated by d2217531 Jules SSRF commit

2026-03-23 23:52:39 +00:00

audit_logs.py

fix: merge main branch and renumber migration 027→037

2026-03-16 22:40:15 +00:00

automation.py

fix: restore all code deleted/truncated by d2217531 Jules SSRF commit

2026-03-23 23:52:39 +00:00

azure.py

style: fix all flake8 linter errors across app/ directory

2026-02-08 17:42:33 +00:00

backup.py

feat(backup): extend backup and restore to PostgreSQL and MySQL/MariaDB

2026-03-08 09:56:58 +00:00

billing.py

fix: resolve failing tests in main

2026-03-23 18:51:28 +00:00

classification_rules.py

fix: restore all code deleted/truncated by d2217531 Jules SSRF commit

2026-03-23 23:52:39 +00:00

comments.py

fix: restore all code deleted/truncated by d2217531 Jules SSRF commit

2026-03-23 23:52:39 +00:00

common.py

refactor: consolidate get_db into single module

2026-02-09 15:37:23 +00:00

compliance.py

fix: merge main branch and renumber migration 027→037

2026-03-16 22:40:15 +00:00

database.py

fix: address code review feedback

2026-03-05 22:22:49 +00:00

diagnostic.py

fix: restore all code deleted/truncated by d2217531 Jules SSRF commit

2026-03-23 23:52:39 +00:00

dropbox.py

fix(api): remove duplicate Depends from AdminUser parameters in dropbox, onedrive, google_drive

2026-03-24 01:30:17 +00:00

duplicates.py

fix: merge main branch and renumber migration 027→037

2026-03-16 22:40:15 +00:00

files.py

fix: restore all code deleted/truncated by d2217531 Jules SSRF commit

2026-03-23 23:52:39 +00:00

google_drive.py

fix(api): track env_file_written accurately in save_google_drive_settings

2026-03-24 20:24:35 +00:00

graphql_api.py

fix: merge main branch and renumber migration 027→037

2026-03-16 22:40:15 +00:00

i18n.py

fix: merge main branch and renumber migration 027→037

2026-03-16 22:40:15 +00:00

imap_accounts.py

🛡️ Sentinel: [HIGH] Fix Server-Side Request Forgery in IMAP connections

2026-03-23 14:38:34 +00:00

imap_profiles.py

fix: merge main branch and renumber migration 027→037

2026-03-16 22:40:15 +00:00

integrations.py

🛡️ Sentinel: [HIGH] Fix SSRF in integrations connection test

2026-03-26 04:00:55 +00:00

local_auth.py

fix: resolve failing tests in main

2026-03-23 18:51:28 +00:00

logs.py

feat(security): add comprehensive input validation and sanitization (#172)

2026-02-22 16:02:00 +00:00

mobile.py

fix: restore all code deleted/truncated by d2217531 Jules SSRF commit

2026-03-23 23:52:39 +00:00

notifications.py

fix: merge main branch and renumber migration 027→037

2026-03-16 22:40:15 +00:00

onboarding.py

feat(notifications): admin push notifications and webhooks for user signup, plan changes, and payment issues

2026-03-07 20:15:39 +00:00

onedrive.py

fix(api): remove duplicate Depends from AdminUser parameters in dropbox, onedrive, google_drive

2026-03-24 01:30:17 +00:00

openai.py

fix(api): swap parameter order in test_ai_extraction to fix 500 error

2026-02-23 21:35:36 +00:00

pipelines.py

fix: restore all code deleted/truncated by d2217531 Jules SSRF commit

2026-03-23 23:52:39 +00:00

plans.py

fix: merge main branch and renumber migration 027→037

2026-03-16 22:40:15 +00:00

process.py

Apply Black and isort formatting to modified files

2026-02-07 15:00:18 +00:00

profile.py

fix: merge main branch and renumber migration 027→037

2026-03-16 22:40:15 +00:00

qr_auth.py

fix: restore all code deleted/truncated by d2217531 Jules SSRF commit

2026-03-23 23:52:39 +00:00

queue.py

refactor(queue): address code review feedback — extract constants and sync refresh interval

2026-02-27 00:47:58 +00:00

routing_rules.py

fix: merge main branch and renumber migration 027→037

2026-03-16 22:40:15 +00:00

saved_searches.py

fix(security): address CodeQL clear-text logging and weak hashing alerts

2026-03-08 19:33:55 +00:00

scheduled_jobs.py

fix: code standards audit — 100% coverage, Pydantic v2 model_config, asyncio.run(), targeted edge-case tests

2026-03-09 19:00:13 +00:00

search.py

feat(search): add content-finding filters, saved searches, and text quality to Search view

2026-03-01 13:46:15 +00:00

sessions.py

fix: merge main branch and renumber migration 037→040

2026-03-20 23:54:04 +00:00

settings.py

fix: restore all code deleted/truncated by d2217531 Jules SSRF commit

2026-03-23 23:52:39 +00:00

shared_links.py

fix: merge main branch and renumber migration 027→037

2026-03-16 22:40:15 +00:00

sharing.py

fix: restore all code deleted/truncated by d2217531 Jules SSRF commit

2026-03-23 23:52:39 +00:00

similarity.py

fix(similarity): address code review - column-only queries, configurable batch size, WCAG touch targets

2026-03-02 13:39:10 +00:00

subscriptions.py

feat(subscriptions): add subscription change management with upgrade/downgrade scheduling

2026-03-07 20:14:12 +00:00

system_reset.py

fix: merge main branch and renumber migration 037→040

2026-03-20 23:54:04 +00:00

translation.py

fix: merge main branch and renumber migration 027→037

2026-03-16 22:40:15 +00:00

url_upload.py

fix: resolve ssrf verification issue and xss in frontend

2026-05-17 14:32:51 +00:00

user.py

fix: merge main branch and renumber migration 027→037

2026-03-16 22:40:15 +00:00

webhooks.py

feat(webhooks): add webhook support for external integrations

2026-03-01 20:42:57 +00:00