mirror of https://github.com/pewdiepie-archdaemon/odysseus.git synced 2026-10-29 17:22:25 +01:00

Files

T

Alexandre Teixeira de8f151632 fix(security): harden trace teardown and gallery error responses

- CodeQL #1202 (tests/e2e/teardown.js): replace execSync shell execution with
  execFileSync, passing python executable and sanitizer arguments separately with
  shell: false. Preserve ODYSSEUS_TEST_PYTHON support, timeout handling, and
  fail-closed deletion.
- CodeQL #1203 (routes/gallery/gallery_routes.py): prevent exception information
  exposure in /api/image/edit-progress by returning a generic rejection response
  without leaking internal hostnames, IPs, resolver errors, or credentials.
- Add regression tests covering paths with spaces, metacharacters, synthetic command
  substitutions, process failure modes, fail-closed artifact purge, and SSRF
  rejection confidentiality.

2026-10-28 21:10:12 +00:00

photo-editor

merge(dev): reconcile photo editor security and upstream changes

2026-10-28 19:30:08 +00:00

playwright.config.js

feat(editor): harden photo editor security and interactions

2026-10-28 17:37:10 +00:00

README.md

feat(editor): harden photo editor security and interactions

2026-10-28 17:37:10 +00:00

setup.js

feat(editor): harden photo editor security and interactions

2026-10-28 17:37:10 +00:00

teardown.js

fix(security): harden trace teardown and gallery error responses

2026-10-28 21:10:12 +00:00

README.md

Browser End-to-End Tests

The photo editor release gate launches an isolated Odysseus server on port 7013 with a temporary SQLite database and disposable authenticated account.

npm install
npm run test:photo-editor:install
npm run test:photo-editor

Set PHOTO_EDITOR_E2E_PORT to use another port. Failure screenshots and traces are written to test-results/photo-editor/. The server uses the repository .venv automatically; set ODYSSEUS_TEST_PYTHON to another Python executable when using a different environment layout.

The disposable account is created in the temporary data directory and exercises owner-scoped draft and notification routes without using an existing account. PHOTO_EDITOR_E2E_AUTH=0 selects the legacy unauthenticated configuration for investigating it; offline-upgrade coverage requires the authenticated mode.