sirdave73/epub2pdf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12 Commits 2 Branches 0 Tags
069dab0411d794ac882a85b104772248ddf0916c
Commit Graph
12 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Amelia 069dab0411 feat(render-mode): Rich (LibreOffice) vs Standard (pandoc) toggle for office formats (.docx/.odt/.rtf); Rich default; 5 office tests; 152/152 green"
Test / Tests (Python 3.12) (push) Canceled after 0s
Details
2026-09-04 17:31:26 -04:00
sirdave73 383635c57c Fix: frontend validator rejected .docx (added pandoc-family extensions to OKEXT)
Test / Tests (Python 3.12) (push) Canceled after 0s
Details
2026-09-04 11:01:41 -04:00
sirdave73 fa558ccfb3 UI redesign v2: modern ant/mono design + app version (v2.0.0)
Test / Tests (Python 3.12) (push) Canceled after 0s
Details
2026-09-04 07:22:43 -04:00
sirdave73 7ea2b2baad H1+M2 review findings: CSV 5000x50 render cap (truncated with note) + stale output sweep; 4 regression tests (H1x3, M2x1); USER_GUIDE truncation docs
Test / Tests (Python 3.12) (push) Canceled after 0s
Details
2026-09-04 06:34:20 -04:00
sirdave73 72b5f2f0dd C1+C3 review findings: streaming decompression-bomb guard + stored-XSS stripping
Test / Tests (Python 3.12) (push) Canceled after 0s
Details 
C1 (decompression bomb): wire the shared common._copy_stream_with_cap into both
zip-extraction paths. app.py._safe_extract_zip now streams each EPUB member with
a WRITTEN-byte counter (app.py:456) instead of an unbounded copyfileobj, so a
member that inflates a small header into a huge stream is stopped mid-write.
pandoc_converter._validate_office_zip now streams every member's decompressed
bytes through the same guard (pandoc_converter.py:134) before pandoc reads them.

C3 (stored XSS): common.html_to_pdf_bytes now strips stored-XSS vectors via
common._strip_scripts (common.py:320) BEFORE WeasyPrint renders, so every
non-pandoc render path (html, svg, epub, md, csv, xml) neutralizes <script>/
<iframe> content, on* handlers and javascript:/vbscript: URLs. Regression tests
added to tests/test_review_findings_20260903.py (C1 unit+e2e, C3 unit+e2e).
 2026-09-04 02:25:07 -04:00
sirdave73 51d39fead1 C2 SSRF fix: pre-validate HTML resource refs before WeasyPrint render
Test / Tests (Python 3.12) (push) Canceled after 0s
Details 
WeasyPrint's image loader swallows per-fetch errors and renders a broken
image, so a job could report DONE while a remote URL was contacted
(SSRF/data egress against the no-data-egress guarantee). Add
scan_for_remote() which rejects http(s)/ftp/ws/wss/file resource
references up-front (ValueError -> job error) before WeasyPrint ever
runs; local data: URIs still render via the default loader. Also add
tests/test_review_findings_20260903.py (remote -> job error, valid
data: -> job done).
 2026-09-04 00:18:17 -04:00
sirdave73 41fd734a29 Add CI/CD test pipeline (Gitea Actions) — Python 3.12 + pandoc + pytest
Test / Tests (Python 3.12) (push) Canceled after 0s
Details
2026-09-03 13:25:36 -04:00
sirdave73 b19d8d3f52 any-file to PDF (Phase 2, Chunk A): pandoc converters for docx/odt/rtf/tex/latex/org/adoc/rst, 27 formats, 126 tests green 2026-09-02 21:55:22 -04:00
sirdave73 2931d547de docs: USER_GUIDE updated for 18-format support (Phase 1) 2026-09-02 03:03:43 -04:00
sirdave73 345c39417b any-file to PDF (Phase 1): converters/ dispatcher, images/text/md/csv/json/xml/svg/pdf-passthrough, 112 tests green 2026-09-02 01:53:24 -04:00
sirdave73 0b575a3e1f Dockerfile: pure-python HEALTHCHECK (slim image has no curl/wget); Coolify honors it and skips its own check 2026-08-30 15:44:19 -04:00
BMad Master 5580004aeb epub2pdf: title-based export names, .pdf download headers, security hardening (68 tests green) 2026-08-30 09:03:39 -04:00