helm/ulysses
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ulysses/routes
History
Alexandre Teixeira 2412db1583
fix(security): harden gallery endpoint URL checks (#4981) 
Replace substring OpenAI endpoint detection with exact parsed-host matching.

Route gallery image endpoint construction through a constant path allowlist.

Remove client-visible exception and upstream response body leaks from gallery image flows while preserving diagnostics in server logs.

Add focused regression tests for OpenAI host matching, checked endpoint joining, harmonize SSRF hardening, and sanitized client errors.
2026-06-30 19:16:34 +02:00
..
gallery fix(security): harden gallery endpoint URL checks (#4981) 2026-06-30 19:16:34 +02:00
memory refactor(routes): move memory domain into routes/memory/ subpackage (#5007) 2026-06-30 17:52:14 +02:00
research refactor(routes): move research domain into routes/research/ subpackage 2026-06-28 14:34:11 +01:00
__init__.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
_validators.py fix(hwfit): validate remote SSH detection targets (#3718) 2026-06-11 00:43:49 +02:00
admin_wipe_routes.py refactor(constants): single source of truth for data dir (#3368) 2026-06-08 09:58:52 +02:00
api_token_routes.py fix(api): normalize non-object JSON bodies to empty dict in token PATCH (#3976) 2026-06-15 18:05:15 +01:00
assistant_routes.py fix(auth): centralize password and username validation constants (#4120) 2026-06-16 09:52:15 +02:00
auth_routes.py fix(auth): tie remember-me cookie lifetime to TOKEN_TTL (#4472) 2026-06-18 21:15:48 +02:00
backup_routes.py fix: backup import dropping a user's skill on cross-tenant title/id collision (#2057) 2026-06-09 08:04:22 +02:00
calendar_routes.py fix(calendar): accept time-first datetimes in _parse_dt 2026-06-27 18:51:18 +01:00
chat_helpers.py fix: improve uploaded document retrieval and deep research reuse (#4784) 2026-06-27 19:24:17 +01:00
chat_routes.py fix: improve uploaded document retrieval and deep research reuse (#4784) 2026-06-27 19:24:17 +01:00
chatgpt_subscription_routes.py feat: add ChatGPT Subscription provider (#2876) 2026-06-08 10:19:18 +02:00
cleanup_routes.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
codex_routes.py fix: improve uploaded document retrieval and deep research reuse (#4784) 2026-06-27 19:24:17 +01:00
compare_routes.py fix(endpoint): scope secondary endpoint lookups by owner 2026-06-08 11:51:55 +01:00
contacts_routes.py fix: vCard parser drops folded continuation lines, corrupting emails (#1870) 2026-06-27 14:41:57 +01:00
cookbook_helpers.py fix(cookbook): accept $(find) subshells in serve command validation 2026-06-28 14:00:49 +01:00
cookbook_output.py fix(cookbook): report dead finished downloads as completed instead of stopped (#4025) 2026-06-15 15:26:55 +09:00
cookbook_routes.py fix(cookbook): treat local Windows as Windows for serve commands (#3975) 2026-06-26 13:13:01 +01:00
copilot_routes.py feat: add ChatGPT Subscription provider (#2876) 2026-06-08 10:19:18 +02:00
device_flow.py feat: add ChatGPT Subscription provider (#2876) 2026-06-08 10:19:18 +02:00
diagnostics_routes.py feat(ui): add real-time diagnostic logs console (#974) 2026-06-15 10:32:51 +02:00
document_helpers.py fix: document read fails with 403 when auth is disabled (#4623) 2026-06-22 21:01:11 +02:00
document_routes.py fix: document read fails with 403 when auth is disabled (#4623) 2026-06-22 21:01:11 +02:00
editor_draft_routes.py Ignore invalid editor draft payloads (#1533) 2026-06-03 14:07:03 +09:00
email_helpers.py fix(email): don't probe IMAP for send-only (SMTP-only) accounts (#4830) 2026-06-27 21:52:26 +01:00
email_pollers.py fix: email poller marks calendar extraction processed on LLM failure (#4622) 2026-06-23 20:32:30 +02:00
email_routes.py fix(email): don't probe IMAP for send-only (SMTP-only) accounts (#4830) 2026-06-27 21:52:26 +01:00
embedding_routes.py feat(paths): abstract runtime path logic for frozen distribution packages (#969) 2026-06-15 17:44:10 +01:00
emoji_routes.py refactor(constants): single source of truth for data dir (#3368) 2026-06-08 09:58:52 +02:00
font_routes.py Keep compact font family names together (#1263) 2026-06-03 14:24:30 +09:00
gallery_helpers.py refactor(routes): move gallery domain into routes/gallery subpackage (#4903) 2026-06-28 10:40:34 +01:00
gallery_routes.py refactor(routes): move gallery domain into routes/gallery subpackage (#4903) 2026-06-28 10:40:34 +01:00
history_routes.py fix(sessions): copy message metadata when forking a session (#3409) 2026-06-08 20:49:15 +02:00
hwfit_routes.py CodeQL hardening for cookbook sync 2026-06-22 02:39:18 +00:00
mcp_routes.py fix(mcp): share oauth redirect URI (#4087) 2026-06-15 15:15:53 +09:00
memory_routes.py refactor(routes): move memory domain into routes/memory/ subpackage (#5007) 2026-06-30 17:52:14 +02:00
model_routes.py fix(models): accept bare-list /models responses (Together AI) (#4761) 2026-06-27 16:25:15 +01:00
note_routes.py fix(security): redact credential-bearing URLs and PII from logs (#4750) 2026-06-22 23:12:39 +02:00
personal_routes.py fix(personal): scope RAG file delete to the caller's own upload dir (#4602) 2026-06-20 00:50:15 +02:00
prefs_routes.py refactor(constants): single source of truth for data dir (#3368) 2026-06-08 09:58:52 +02:00
preset_routes.py fix(ai): offload model resolution from async paths 2026-06-28 00:48:35 +01:00
research_routes.py refactor(routes): move research domain into routes/research/ subpackage 2026-06-28 14:34:11 +01:00
search_routes.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
session_routes.py fix(auth): clean up rename and null-owner ownership (#4340) 2026-06-16 03:33:02 +01:00
shell_routes.py fix(cookbook): load user-site pth hooks for runtime installs 2026-06-28 01:01:44 +01:00
signature_routes.py Constrain signature uploads to PNG data (#2844) 2026-06-05 13:17:43 +02:00
skills_routes.py fix(security): prevent ReDoS in verdict-prose and continuation matchers (#4943) 2026-06-28 11:42:20 +01:00
stt_routes.py refactor(uploads): centralize upload byte-limits in upload_limits.py (#3364) (#3518) 2026-06-09 01:24:30 +02:00
task_routes.py refactor(auth): centralize the internal-tool pseudo-username into a constant (#4333) 2026-06-16 13:13:00 +02:00
tts_routes.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
upload_routes.py fix(upload): handle corrupt uploads index and malformed vision JSON 2026-06-27 18:59:28 +01:00
vault_routes.py refactor(constants): single source of truth for data dir (#3368) 2026-06-08 09:58:52 +02:00
webhook_routes.py fix(models): accept bare-list /models responses (Together AI) (#4761) 2026-06-27 16:25:15 +01:00
workspace_routes.py feat(agent): confine agent file/shell tools to a selectable workspace (#3665) 2026-06-11 18:17:54 +02:00