sirdave73
51d39fead1
Test / Tests (Python 3.12) (push) Canceled after 0s
WeasyPrint's image loader swallows per-fetch errors and renders a broken image, so a job could report DONE while a remote URL was contacted (SSRF/data egress against the no-data-egress guarantee). Add scan_for_remote() which rejects http(s)/ftp/ws/wss/file resource references up-front (ValueError -> job error) before WeasyPrint ever runs; local data: URIs still render via the default loader. Also add tests/test_review_findings_20260903.py (remote -> job error, valid data: -> job done).