mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-08-11 05:45:32 +00:00
e5ec82475c
Hardens issues found in a security review of the current tree (separate from
the cookbook SSH PR):
- Email thread rendering (static/js/emailLibrary.js): the flat read path runs
inbound HTML through the allowlist sanitizer, but the two threaded paths
(_renderTurnsAsBubbles / _renderTurnsFromServer — the default view) injected
server-parsed `body_html` raw into the DOM. A crafted inbound email could
inject arbitrary markup (phishing/form/credential-capture/tracking; full XSS
if a deployment relaxes the script CSP). Now sanitized on all paths.
- Attachment extraction (routes/email_routes.py, routes/email_helpers.py): the
on-disk extraction dir was `ATTACHMENTS_DIR / f"{folder}_{uid}"` with
user-controlled folder/uid and no containment, so a folder like `../../tmp`
could escape ATTACHMENTS_DIR. New attachment_extract_dir() flattens both to a
single safe segment and asserts containment.
- Diagnostics routes (routes/diagnostics_routes.py): /api/db/stats,
/api/rag/stats, /api/test/youtube, /api/test-research relied only on the
global session check (any logged-in user). Now require_admin-gated.
- Defense-in-depth HTML escaping: session HTML export escapes the session name
(routes/session_routes.py); the MCP OAuth page escapes the reflected Host
header / server_id (routes/mcp_routes.py).
- Internal-tool token now compared with secrets.compare_digest (constant time)
in core/middleware.py and app.py.
Adds regression tests in tests/test_security_regressions.py.
|
||
|---|---|---|
| .. | ||
| calendar | ||
| compare | ||
| editor | ||
| emailLibrary | ||
| research | ||
| admin.js | ||
| assistant.js | ||
| calendar.js | ||
| censor.js | ||
| chat.js | ||
| chatRenderer.js | ||
| chatStream.js | ||
| codeRunner.js | ||
| colorPicker.js | ||
| cookbook-diagnosis.js | ||
| cookbook-hwfit.js | ||
| cookbook.js | ||
| cookbookDownload.js | ||
| cookbookRunning.js | ||
| cookbookServe.js | ||
| document.js | ||
| documentLibrary.js | ||
| dragSort.js | ||
| emailInbox.js | ||
| emailLibrary.js | ||
| emojiPicker.js | ||
| fileHandler.js | ||
| gallery.js | ||
| galleryEditor.js | ||
| group.js | ||
| init.js | ||
| keyboard-shortcuts.js | ||
| langIcons.js | ||
| markdown.js | ||
| memory.js | ||
| modalManager.js | ||
| modalSnap.js | ||
| modelPicker.js | ||
| models.js | ||
| modelSort.js | ||
| MODULE_SUMMARY.md | ||
| notes.js | ||
| presets.js | ||
| providers.js | ||
| rag.js | ||
| researchSynapse.js | ||
| search-chat.js | ||
| search.js | ||
| section-management.js | ||
| sessions.js | ||
| settings.js | ||
| sidebar-layout.js | ||
| signature.js | ||
| skills.js | ||
| slashCommands.js | ||
| spinner.js | ||
| storage.js | ||
| tasks.js | ||
| theme.js | ||
| tileManager.js | ||
| tourAutoplay.js | ||
| tourHints.js | ||
| tts-ai.js | ||
| ui.js | ||
| voiceRecorder.js | ||
| windowDrag.js | ||