3 Commits

Include renames

Author	SHA1	Message	Date
Alexandre Teixeira	6d102a213f	fix(security): confine teardown paths and avoid interpolating exception data in logs ... - routes/gallery/gallery_routes.py: use stable diagnostic log message without interpolating raw exception, resolver details, tokens, or destination strings. - tests/e2e/teardown.js: remove environment-variable path overrides from production code, strictly confine test options and temp directories, and prevent arbitrary directory cleanup. - Add regression tests covering non-leakage of synthetic tokens/queries/exceptions into logs and responses, and path confinement during teardown.	2026-10-28 21:14:43 +00:00
Alexandre Teixeira	de8f151632	fix(security): harden trace teardown and gallery error responses ... - CodeQL #1202 (tests/e2e/teardown.js): replace execSync shell execution with execFileSync, passing python executable and sanitizer arguments separately with shell: false. Preserve ODYSSEUS_TEST_PYTHON support, timeout handling, and fail-closed deletion. - CodeQL #1203 (routes/gallery/gallery_routes.py): prevent exception information exposure in /api/image/edit-progress by returning a generic rejection response without leaking internal hostnames, IPs, resolver errors, or credentials. - Add regression tests covering paths with spaces, metacharacters, synthetic command substitutions, process failure modes, fail-closed artifact purge, and SSRF rejection confidentiality.	2026-10-28 21:10:12 +00:00
Alexandre Teixeira	c237a1cb9c	feat(editor): harden photo editor security and interactions	2026-10-28 17:37:10 +00:00