7 Commits

Include renames

Author	SHA1	Message	Date
Amelia	069dab0411	feat(render-mode): Rich (LibreOffice) vs Standard (pandoc) toggle for office formats (.docx/.odt/.rtf); Rich default; 5 office tests; 152/152 green"	2026-09-04 17:31:26 -04:00
sirdave73	7ea2b2baad	H1+M2 review findings: CSV 5000x50 render cap (truncated with note) + stale output sweep; 4 regression tests (H1x3, M2x1); USER_GUIDE truncation docs	2026-09-04 06:34:20 -04:00
sirdave73	72b5f2f0dd	C1+C3 review findings: streaming decompression-bomb guard + stored-XSS stripping ... C1 (decompression bomb): wire the shared common._copy_stream_with_cap into both zip-extraction paths. app.py._safe_extract_zip now streams each EPUB member with a WRITTEN-byte counter (app.py:456) instead of an unbounded copyfileobj, so a member that inflates a small header into a huge stream is stopped mid-write. pandoc_converter._validate_office_zip now streams every member's decompressed bytes through the same guard (pandoc_converter.py:134) before pandoc reads them. C3 (stored XSS): common.html_to_pdf_bytes now strips stored-XSS vectors via common._strip_scripts (common.py:320) BEFORE WeasyPrint renders, so every non-pandoc render path (html, svg, epub, md, csv, xml) neutralizes <script>/ <iframe> content, on* handlers and javascript:/vbscript: URLs. Regression tests added to tests/test_review_findings_20260903.py (C1 unit+e2e, C3 unit+e2e).	2026-09-04 02:25:07 -04:00
sirdave73	51d39fead1	C2 SSRF fix: pre-validate HTML resource refs before WeasyPrint render ... WeasyPrint's image loader swallows per-fetch errors and renders a broken image, so a job could report DONE while a remote URL was contacted (SSRF/data egress against the no-data-egress guarantee). Add scan_for_remote() which rejects http(s)/ftp/ws/wss/file resource references up-front (ValueError -> job error) before WeasyPrint ever runs; local data: URIs still render via the default loader. Also add tests/test_review_findings_20260903.py (remote -> job error, valid data: -> job done).	2026-09-04 00:18:17 -04:00
sirdave73	b19d8d3f52	any-file to PDF (Phase 2, Chunk A): pandoc converters for docx/odt/rtf/tex/latex/org/adoc/rst, 27 formats, 126 tests green	2026-09-02 21:55:22 -04:00
sirdave73	345c39417b	any-file to PDF (Phase 1): converters/ dispatcher, images/text/md/csv/json/xml/svg/pdf-passthrough, 112 tests green	2026-09-02 01:53:24 -04:00
BMad Master	5580004aeb	epub2pdf: title-based export names, .pdf download headers, security hardening (68 tests green)	2026-08-30 09:03:39 -04:00