mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-11-06 07:58:00 +00:00
e5ec82475c
Hardens issues found in a security review of the current tree (separate from
the cookbook SSH PR):
- Email thread rendering (static/js/emailLibrary.js): the flat read path runs
inbound HTML through the allowlist sanitizer, but the two threaded paths
(_renderTurnsAsBubbles / _renderTurnsFromServer — the default view) injected
server-parsed `body_html` raw into the DOM. A crafted inbound email could
inject arbitrary markup (phishing/form/credential-capture/tracking; full XSS
if a deployment relaxes the script CSP). Now sanitized on all paths.
- Attachment extraction (routes/email_routes.py, routes/email_helpers.py): the
on-disk extraction dir was `ATTACHMENTS_DIR / f"{folder}_{uid}"` with
user-controlled folder/uid and no containment, so a folder like `../../tmp`
could escape ATTACHMENTS_DIR. New attachment_extract_dir() flattens both to a
single safe segment and asserts containment.
- Diagnostics routes (routes/diagnostics_routes.py): /api/db/stats,
/api/rag/stats, /api/test/youtube, /api/test-research relied only on the
global session check (any logged-in user). Now require_admin-gated.
- Defense-in-depth HTML escaping: session HTML export escapes the session name
(routes/session_routes.py); the MCP OAuth page escapes the reflected Host
header / server_id (routes/mcp_routes.py).
- Internal-tool token now compared with secrets.compare_digest (constant time)
in core/middleware.py and app.py.
Adds regression tests in tests/test_security_regressions.py.
|
||
|---|---|---|
| .. | ||
| __init__.py | ||
| admin_wipe_routes.py | ||
| api_token_routes.py | ||
| assistant_routes.py | ||
| auth_routes.py | ||
| backup_routes.py | ||
| calendar_routes.py | ||
| chat_helpers.py | ||
| chat_routes.py | ||
| cleanup_routes.py | ||
| compare_routes.py | ||
| contacts_routes.py | ||
| cookbook_helpers.py | ||
| cookbook_routes.py | ||
| diagnostics_routes.py | ||
| document_helpers.py | ||
| document_routes.py | ||
| editor_draft_routes.py | ||
| email_helpers.py | ||
| email_pollers.py | ||
| email_routes.py | ||
| embedding_routes.py | ||
| emoji_routes.py | ||
| font_routes.py | ||
| gallery_helpers.py | ||
| gallery_routes.py | ||
| history_routes.py | ||
| hwfit_routes.py | ||
| mcp_routes.py | ||
| memory_routes.py | ||
| model_routes.py | ||
| note_routes.py | ||
| personal_routes.py | ||
| prefs_routes.py | ||
| preset_routes.py | ||
| research_routes.py | ||
| search_routes.py | ||
| session_routes.py | ||
| shell_routes.py | ||
| signature_routes.py | ||
| skills_routes.py | ||
| stt_routes.py | ||
| task_routes.py | ||
| tts_routes.py | ||
| upload_routes.py | ||
| vault_routes.py | ||
| webhook_routes.py | ||