sirdave73/epub2pdf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
19 Commits 2 Branches 0 Tags
DEV-TEST
Commit Graph
7 Commits
Author SHA1 Message Date
Amelia 069dab0411 feat(render-mode): Rich (LibreOffice) vs Standard (pandoc) toggle for office formats (.docx/.odt/.rtf); Rich default; 5 office tests; 152/152 green"
Test / Tests (Python 3.12) (push) Canceled after 0s
Details
2026-09-04 17:31:26 -04:00
sirdave73 7ea2b2baad H1+M2 review findings: CSV 5000x50 render cap (truncated with note) + stale output sweep; 4 regression tests (H1x3, M2x1); USER_GUIDE truncation docs
Test / Tests (Python 3.12) (push) Canceled after 0s
Details
2026-09-04 06:34:20 -04:00
sirdave73 72b5f2f0dd C1+C3 review findings: streaming decompression-bomb guard + stored-XSS stripping
Test / Tests (Python 3.12) (push) Canceled after 0s
Details 
C1 (decompression bomb): wire the shared common._copy_stream_with_cap into both
zip-extraction paths. app.py._safe_extract_zip now streams each EPUB member with
a WRITTEN-byte counter (app.py:456) instead of an unbounded copyfileobj, so a
member that inflates a small header into a huge stream is stopped mid-write.
pandoc_converter._validate_office_zip now streams every member's decompressed
bytes through the same guard (pandoc_converter.py:134) before pandoc reads them.

C3 (stored XSS): common.html_to_pdf_bytes now strips stored-XSS vectors via
common._strip_scripts (common.py:320) BEFORE WeasyPrint renders, so every
non-pandoc render path (html, svg, epub, md, csv, xml) neutralizes <script>/
<iframe> content, on* handlers and javascript:/vbscript: URLs. Regression tests
added to tests/test_review_findings_20260903.py (C1 unit+e2e, C3 unit+e2e).
 2026-09-04 02:25:07 -04:00
sirdave73 51d39fead1 C2 SSRF fix: pre-validate HTML resource refs before WeasyPrint render
Test / Tests (Python 3.12) (push) Canceled after 0s
Details 
WeasyPrint's image loader swallows per-fetch errors and renders a broken
image, so a job could report DONE while a remote URL was contacted
(SSRF/data egress against the no-data-egress guarantee). Add
scan_for_remote() which rejects http(s)/ftp/ws/wss/file resource
references up-front (ValueError -> job error) before WeasyPrint ever
runs; local data: URIs still render via the default loader. Also add
tests/test_review_findings_20260903.py (remote -> job error, valid
data: -> job done).
 2026-09-04 00:18:17 -04:00
sirdave73 b19d8d3f52 any-file to PDF (Phase 2, Chunk A): pandoc converters for docx/odt/rtf/tex/latex/org/adoc/rst, 27 formats, 126 tests green 2026-09-02 21:55:22 -04:00
sirdave73 345c39417b any-file to PDF (Phase 1): converters/ dispatcher, images/text/md/csv/json/xml/svg/pdf-passthrough, 112 tests green 2026-09-02 01:53:24 -04:00
BMad Master 5580004aeb epub2pdf: title-based export names, .pdf download headers, security hardening (68 tests green) 2026-08-30 09:03:39 -04:00