mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-20 23:31:31 +02:00
Yogesh OjhaandClaude Opus 5
0522444245
Uploaded typefaces and instance-wide branding defaults, which together make a report genuinely white-labellable: a client's own font, a logo set once, and a theme that names both. The security half came first, because the logo field was a live SSRF. It was a free-text string rendered into an <img src>, and WeasyPrint would have fetched whatever it pointed at from inside the worker. Nothing fetches now, at four layers. The load-bearing one is a WeasyPrint url_fetcher that allows data: URIs and files under three known roots and refuses everything else; it was checked against cloud metadata, internal https, loopback, /etc/passwd, a UNC host, ftp and protocol-relative references. Above it sit three input guards: a logo must be embedded data of a known image type, an uploaded theme may not use @import or a url() that is not data:, and authored markdown loses any image that is not embedded. A new feature that lets a report name a resource goes through the fetcher, not around it. A typeface is bytes, never a link. The family row records files named by us, so a hostile filename never reaches disk, and the family directory refuses anything resolving outside itself. A face is accepted only when the bytes agree: the signature is sniffed and then fontTools opens it and requires outlines, which is why fonttools is now an api dependency rather than only a WeasyPrint one. A 5-byte file with a valid TTF header and a 4 KB file of padding are both refused. The family name is banned from carrying quotes or braces because it is written into a quoted CSS font-family string. The standalone HTML export now embeds only the families the theme actually names, which halves it, and no longer carries file:// references that would have been dead outside the container. Instance defaults fill only what a template leaves blank, so setting a logo once never overrides a per-client deliverable that set its own. Verified: a real TTF family uploaded and embedded in a 53-page PDF under an uploaded theme with an uploaded logo, and every probe above refused. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017f2Mf2HGwFaTRnui4UxpRd
82 lines
2.8 KiB
Python
82 lines
2.8 KiB
Python
import uuid
|
|
from datetime import datetime
|
|
|
|
from pydantic import BaseModel
|
|
from sqlalchemy import Column
|
|
from sqlalchemy.types import JSON
|
|
from sqlmodel import Field, SQLModel, UniqueConstraint
|
|
|
|
from shared.enums.instance import InstanceMode
|
|
from shared.utils.datetime import utc_now
|
|
|
|
|
|
class InstanceSettings(SQLModel, table=True):
|
|
__tablename__ = "instance_settings"
|
|
__table_args__ = (
|
|
UniqueConstraint("singleton_key", name="uq_instance_settings_singleton"),
|
|
)
|
|
|
|
id: uuid.UUID = Field(default_factory=uuid.uuid4, primary_key=True, index=True)
|
|
singleton_key: str = Field(default="instance", max_length=20)
|
|
instance_name: str = Field(default="reNgine", max_length=120)
|
|
timezone: str = Field(default="UTC", max_length=64)
|
|
mode: str = Field(default=InstanceMode.BUG_BOUNTY.value)
|
|
onboarding_completed: bool = Field(default=False)
|
|
onboarding_completed_at: datetime | None = Field(default=None)
|
|
onboarding_completed_by: uuid.UUID | None = Field(default=None)
|
|
onboarding_step: int = Field(default=0)
|
|
onboarding_state: dict = Field(
|
|
default_factory=dict, sa_column=Column(JSON, nullable=False)
|
|
)
|
|
scan_history_retention_days: int = Field(default=90)
|
|
screenshot_retention_days: int = Field(default=30)
|
|
ai_enabled: bool = Field(default=False)
|
|
ai_provider: str | None = Field(default=None)
|
|
ai_model: str | None = Field(default=None)
|
|
ai_api_key_encrypted: str | None = Field(default=None)
|
|
ai_features: dict = Field(
|
|
default_factory=dict, sa_column=Column(JSON, nullable=False)
|
|
)
|
|
report_defaults: dict = Field(
|
|
default_factory=dict, sa_column=Column(JSON, nullable=False)
|
|
)
|
|
created_at: datetime = Field(default_factory=utc_now)
|
|
updated_at: datetime = Field(default_factory=utc_now)
|
|
|
|
|
|
class InstanceSettingsUpdate(BaseModel):
|
|
instance_name: str | None = None
|
|
timezone: str | None = None
|
|
mode: str | None = None
|
|
scan_history_retention_days: int | None = None
|
|
screenshot_retention_days: int | None = None
|
|
ai_enabled: bool | None = None
|
|
ai_provider: str | None = None
|
|
ai_model: str | None = None
|
|
ai_api_key: str | None = None
|
|
ai_features: dict | None = None
|
|
|
|
|
|
class InstanceSettingsRead(BaseModel):
|
|
id: uuid.UUID
|
|
singleton_key: str
|
|
instance_name: str
|
|
timezone: str
|
|
mode: str
|
|
onboarding_completed: bool
|
|
onboarding_completed_at: datetime | None
|
|
onboarding_completed_by: uuid.UUID | None
|
|
onboarding_step: int
|
|
onboarding_state: dict
|
|
scan_history_retention_days: int
|
|
screenshot_retention_days: int
|
|
ai_enabled: bool
|
|
ai_provider: str | None
|
|
ai_model: str | None
|
|
ai_api_key_masked: str | None
|
|
ai_configured: bool
|
|
ai_features: dict
|
|
capabilities: list[str]
|
|
created_at: datetime
|
|
updated_at: datetime
|