helm/ulysses
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ulysses/src
History
kanaru-dev a51a1fc4fc
Deep-scrub secrets from public settings 
/api/auth/settings is auth-exempt (the frontend + the pre-login page read it for
keybinds/TTS prefs), so non-admin and unauthenticated callers get a scrubbed
copy. The previous scrub only blanked TOP-LEVEL string values whose key matched a
short suffix list — so a secret nested under a non-secret parent key, or stored
under a key outside the list, would leak. A real exposure when the app is
reachable over a Cloudflare tunnel / reverse proxy.

- src/settings_scrub.py: NEW stdlib-only module with the scrub helpers (deep/
  recursive; broadened secret-key patterns). Kept separate from auth_routes so it
  imports + unit-tests WITHOUT pulling the FastAPI / auth / database chain
  (addresses review: the test no longer fails at collection on the DB import).
- routes/auth_routes.py: import scrub_settings from the module.
- tests/test_settings_scrub.py: import the tiny module directly.

Ran: pytest tests/test_settings_scrub.py (8 passed); verified the test pulls no
db/auth modules into sys.modules; py_compile routes/auth_routes.py.

Co-authored-by: Kanaru92 <107661007+Kanaru92@users.noreply.github.com>
2026-06-01 23:11:50 +09:00
..
search Fix year extraction in research queries 2026-06-01 23:09:41 +09:00
action_intents.py Route calendar action requests to tools 2026-06-01 14:32:41 +09:00
agent_loop.py Add SSRF-guarded web fetch agent tool 2026-06-01 16:57:28 +09:00
agent_runs.py Handle incomplete detached agent streams 2026-06-01 16:54:11 +09:00
agent_tools.py Add SSRF-guarded web fetch agent tool 2026-06-01 16:57:28 +09:00
ai_interaction.py feat(ai): add OpenRouter and Ollama Cloud providers (#231) 2026-06-01 14:26:10 +09:00
api_key_manager.py Add native Windows compatibility layer 2026-06-01 15:09:47 +09:00
app_helpers.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
app_initializer.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
assistant_log.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
auth_helpers.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
bg_jobs.py Add native Windows compatibility layer 2026-06-01 15:09:47 +09:00
bg_monitor.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
builtin_actions.py Polish email tasks and window controls 2026-06-01 20:56:46 +09:00
builtin_mcp.py Add native Windows compatibility layer 2026-06-01 15:09:47 +09:00
caldav_sync.py Fix duplicate CalDAV sync UIDs 2026-06-01 02:17:43 +00:00
chat_handler.py Enforce owner checks for upload attachments 2026-06-01 16:47:48 +09:00
chat_helpers.py Recognize local vision models so their images aren't dropped (#185) 2026-06-01 13:09:21 +09:00
chat_processor.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
chroma_client.py fix: ChromaDB unreachable blocks app startup for 30-60s (#326) (#476) 2026-06-01 22:22:41 +09:00
cleanup_service.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
config.py Add native Windows compatibility layer 2026-06-01 15:09:47 +09:00
constants.py Align SearXNG fallback URL 2026-06-01 10:50:07 +09:00
context_compactor.py Preserve system messages during context compaction 2026-06-01 23:10:58 +09:00
database.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
deep_research.py Add Deep Research extraction controls 2026-06-01 14:55:33 +09:00
document_actions.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
document_processor.py Enforce owner checks for upload attachments 2026-06-01 16:47:48 +09:00
email_thread_parser.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
embeddings.py Add native Windows compatibility layer 2026-06-01 15:09:47 +09:00
endpoint_resolver.py feat(ai): add OpenRouter and Ollama Cloud providers (#231) 2026-06-01 14:26:10 +09:00
event_bus.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
exceptions.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
goal_based_extractor.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
integrations.py Secure by default uplift (#511) 2026-06-01 22:30:07 +09:00
llm_core.py Harden streaming deltas against null payloads 2026-06-01 23:09:17 +09:00
mcp_manager.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
memory.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
memory_vector.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
model_context.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
model_discovery.py Improve Ollama setup and model endpoint handling 2026-06-01 10:00:15 +09:00
pdf_form_doc.py Harden PDF document markers against cross-owner upload access (#445) 2026-06-01 22:38:14 +09:00
pdf_forms.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
pdf_runtime.py Show a clear message when PyMuPDF is missing 2026-06-01 18:27:17 +09:00
personal_docs.py Fix chat stream recovery and PDF library indexing (#468) 2026-06-01 22:33:35 +09:00
preset_manager.py Add native Windows compatibility layer 2026-06-01 15:09:47 +09:00
prompt_security.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
rag_manager.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
rag_singleton.py Re-enable VectorRAG init with lazy retry 2026-06-01 14:32:13 +09:00
rag_vector.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
rate_limiter.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
request_models.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
research_handler.py Add native Windows compatibility layer 2026-06-01 15:09:47 +09:00
research_utils.py fix: deep research discards valid sources mentioning cookies/copyright (#481) 2026-06-01 22:26:37 +09:00
secret_storage.py Add native Windows compatibility layer 2026-06-01 15:09:47 +09:00
session_actions.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
settings.py Add SSRF-guarded web fetch agent tool 2026-06-01 16:57:28 +09:00
settings_scrub.py Deep-scrub secrets from public settings 2026-06-01 23:11:50 +09:00
task_endpoint.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
task_scheduler.py Secure by default uplift (#511) 2026-06-01 22:30:07 +09:00
teacher_escalation.py harden(teacher): treat escalation trace as untrusted data (#275) 2026-06-01 14:31:39 +09:00
text_helpers.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
tool_execution.py Add SSRF-guarded web fetch agent tool 2026-06-01 16:57:28 +09:00
tool_implementations.py Add native Windows compatibility layer 2026-06-01 15:09:47 +09:00
tool_index.py Add SSRF-guarded web fetch agent tool 2026-06-01 16:57:28 +09:00
tool_parsing.py Add SSRF-guarded web fetch agent tool 2026-06-01 16:57:28 +09:00
tool_schemas.py Add SSRF-guarded web fetch agent tool 2026-06-01 16:57:28 +09:00
tool_security.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
topic_analyzer.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
upload_handler.py Harden PDF document markers against cross-owner upload access (#445) 2026-06-01 22:38:14 +09:00
visual_report.py Fix visual report chapter navigation (#505) 2026-06-01 22:26:13 +09:00
webhook_manager.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
youtube_handler.py Odysseus v1.0 2026-05-31 23:58:26 +09:00