mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-20 15:21:30 +02:00
Yogesh OjhaandClaude Opus 5
0522444245
Uploaded typefaces and instance-wide branding defaults, which together make a report genuinely white-labellable: a client's own font, a logo set once, and a theme that names both. The security half came first, because the logo field was a live SSRF. It was a free-text string rendered into an <img src>, and WeasyPrint would have fetched whatever it pointed at from inside the worker. Nothing fetches now, at four layers. The load-bearing one is a WeasyPrint url_fetcher that allows data: URIs and files under three known roots and refuses everything else; it was checked against cloud metadata, internal https, loopback, /etc/passwd, a UNC host, ftp and protocol-relative references. Above it sit three input guards: a logo must be embedded data of a known image type, an uploaded theme may not use @import or a url() that is not data:, and authored markdown loses any image that is not embedded. A new feature that lets a report name a resource goes through the fetcher, not around it. A typeface is bytes, never a link. The family row records files named by us, so a hostile filename never reaches disk, and the family directory refuses anything resolving outside itself. A face is accepted only when the bytes agree: the signature is sniffed and then fontTools opens it and requires outlines, which is why fonttools is now an api dependency rather than only a WeasyPrint one. A 5-byte file with a valid TTF header and a 4 KB file of padding are both refused. The family name is banned from carrying quotes or braces because it is written into a quoted CSS font-family string. The standalone HTML export now embeds only the families the theme actually names, which halves it, and no longer carries file:// references that would have been dead outside the container. Instance defaults fill only what a template leaves blank, so setting a logo once never overrides a per-client deliverable that set its own. Verified: a real TTF family uploaded and embedded in a 53-page PDF under an uploaded theme with an uploaded logo, and every probe above refused. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017f2Mf2HGwFaTRnui4UxpRd
199 lines
4.9 KiB
YAML
199 lines
4.9 KiB
YAML
services:
|
|
db:
|
|
image: postgres:16-alpine
|
|
env_file:
|
|
- .env
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
ports:
|
|
- "5432:5432"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U rengine"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
redis:
|
|
image: redis:8-alpine
|
|
ports:
|
|
- "6379:6379"
|
|
volumes:
|
|
- redis_data:/data
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
command: >
|
|
redis-server
|
|
--appendonly yes
|
|
--maxmemory 256mb
|
|
--maxmemory-policy allkeys-lru
|
|
|
|
api:
|
|
build:
|
|
context: .
|
|
dockerfile: api/Dockerfile
|
|
target: development
|
|
volumes:
|
|
- ./api/app:/app/app
|
|
- ./shared:/app/shared
|
|
- ./tools:/app/tools
|
|
- ./stages:/app/stages
|
|
- ./reports:/app/reports
|
|
- ./alembic:/app/alembic
|
|
- ./alembic.ini:/app/alembic.ini
|
|
- ./scan_media:/app/scan_media
|
|
- vuln_templates:/app/vuln-templates
|
|
- wordlists:/app/wordlists
|
|
- reports_out:/app/reports-out
|
|
- report_fonts:/app/report-fonts
|
|
- /app/shared/build
|
|
- /app/shared/rengine_shared.egg-info
|
|
- /app/tools/build
|
|
- /app/tools/rengine_tools.egg-info
|
|
ports:
|
|
- "8000:8000"
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
- WATCHFILES_FORCE_POLLING=true
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
|
|
# default workers for handling regular tasks like imports, whois etc
|
|
worker-default:
|
|
build:
|
|
context: .
|
|
dockerfile: worker/Dockerfile
|
|
target: development
|
|
volumes:
|
|
- ./worker/app:/app/app
|
|
- ./shared:/app/shared
|
|
- ./tools:/app/tools
|
|
- ./stages:/app/stages
|
|
- ./reports:/app/reports
|
|
- ./scan_media:/app/scan_media
|
|
- vuln_templates:/app/vuln-templates
|
|
- wordlists:/app/wordlists
|
|
- reports_out:/app/reports-out
|
|
- report_fonts:/app/report-fonts
|
|
- /app/shared/build
|
|
- /app/shared/rengine_shared.egg-info
|
|
- /app/tools/build
|
|
- /app/tools/rengine_tools.egg-info
|
|
env_file:
|
|
- .env
|
|
command: >
|
|
uv run celery -A app.celery worker
|
|
--loglevel=DEBUG
|
|
--concurrency=${CELERY_SCAN_CONCURRENCY:-8}
|
|
--queues=critical,default,scans
|
|
--hostname=worker-default@%h
|
|
--max-tasks-per-child=100
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "/app/.venv/bin/celery -A app.celery inspect ping -d worker-default@$$HOSTNAME || exit 1"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 30s
|
|
|
|
# beat scheduler: emits the schedule tick that fires due scan schedules
|
|
worker-beat:
|
|
build:
|
|
context: .
|
|
dockerfile: worker/Dockerfile
|
|
target: development
|
|
volumes:
|
|
- ./worker/app:/app/app
|
|
- ./shared:/app/shared
|
|
- ./tools:/app/tools
|
|
- ./stages:/app/stages
|
|
- ./reports:/app/reports
|
|
- ./scan_media:/app/scan_media
|
|
- vuln_templates:/app/vuln-templates
|
|
- wordlists:/app/wordlists
|
|
- reports_out:/app/reports-out
|
|
- report_fonts:/app/report-fonts
|
|
- /app/shared/build
|
|
- /app/shared/rengine_shared.egg-info
|
|
- /app/tools/build
|
|
- /app/tools/rengine_tools.egg-info
|
|
env_file:
|
|
- .env
|
|
command: >
|
|
uv run celery -A app.celery beat
|
|
--loglevel=INFO
|
|
--schedule=/tmp/celerybeat-schedule
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
|
|
flower:
|
|
build:
|
|
context: .
|
|
dockerfile: worker/Dockerfile
|
|
target: development
|
|
volumes:
|
|
- ./worker/app:/app/app
|
|
- ./shared:/app/shared
|
|
- ./tools:/app/tools
|
|
- ./stages:/app/stages
|
|
- ./reports:/app/reports
|
|
- ./scan_media:/app/scan_media
|
|
- vuln_templates:/app/vuln-templates
|
|
- wordlists:/app/wordlists
|
|
- reports_out:/app/reports-out
|
|
- report_fonts:/app/report-fonts
|
|
- /app/shared/build
|
|
- /app/shared/rengine_shared.egg-info
|
|
- /app/tools/build
|
|
- /app/tools/rengine_tools.egg-info
|
|
ports:
|
|
- "5555:5555"
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
- FLOWER_UNAUTHENTICATED_API=true
|
|
command: >
|
|
uv run celery -A app.celery flower
|
|
--port=5555
|
|
--broker=redis://${REDIS_HOST:-redis}:${REDIS_PORT:-6379}/${REDIS_DB:-0}
|
|
--basic-auth=${FLOWER_USER:-admin}:${FLOWER_PASSWORD:-admin}
|
|
depends_on:
|
|
redis:
|
|
condition: service_healthy
|
|
|
|
frontend:
|
|
build:
|
|
context: .
|
|
dockerfile: frontend/Dockerfile.dev
|
|
volumes:
|
|
- ./frontend/src:/app/src
|
|
- ./frontend/vite.config.ts:/app/vite.config.ts
|
|
ports:
|
|
- "5173:5173"
|
|
environment:
|
|
- NODE_ENV=development
|
|
depends_on:
|
|
- api
|
|
|
|
volumes:
|
|
postgres_data:
|
|
redis_data:
|
|
celery_beat_data:
|
|
vuln_templates:
|
|
wordlists:
|
|
reports_out:
|
|
report_fonts:
|