Spaces:
Running
Running
Commit History
-
chore(comments): trim verbose BUG FIX comment in validators.py
Completes the Campaign E comment-cleanup pass across all 17 files that had accumulated multi-paragraph 'BUG FIX' narrative comments -- that history belongs in commit messages, not living in the source forever.65e2f34
-
fix(security): enforce extension_valid instead of silently discarding it
validate_file() computed extension_valid (extension-vs-MIME cross-check, specifically meant to catch spoofed/renamed files) and returned it in the result dict, but hardcoded 'valid': True regardless of its value. Separately, FileValidationResponse (the /api/v1/upload/ validate response model) never declared an extension_valid field at all — Pydantic v2's extra='ignore' default silently dropped it even if the caller had checked it. Net effect, confirmed: /api/v1/upload/validate always reported valid: true for any file with an allowed MIME type, no matter how suspicious the extension. This exact bug was already found and fixed in analyze.py's sibling endpoint (its own comment says 'previously silently discarded') — the fix never propagated to upload.py. Fix: validate_file() now raises FileValidationError when extension_valid is False; FileValidationResponse now declares the field explicitly so it's never silently dropped even in future call sites.99f78e6
-
fix: add extension_valid key to validate_file() — was always True (audit #1)
661db04
-
fix: audit pass — unused imports, None crash guard, emojis, accuracy claims, broken f-strings
206dd1a
-
Optimize file validation order for DoS protection
- Validate file size before MIME type check - Fail fast on oversized files to prevent resource exhaustion - Improved security against DoS attacks83ab126
-
Add file validation utility (#4)
- Implement MIME type validation using python-magic - Add file size limit enforcement (50MB max) - Create FileValidationError for validation failures - Add comprehensive unit tests with fixtures - Use centralized logger for validation events Security features: - Validates actual file content, not just extension - Prevents renamed malicious files (.exe -> .jpg) - Enforces memory-safe size limits Closes #4219cb99
-
Initial commit: Project structure and documentation
- Add professional folder structure (backend, frontend, docs) - Create README with project overview and roadmap - Add MIT license for open-source compliance - Configure .gitignore for Python, env files, and privacy - Set up placeholder files for modular architecture68e39ae