mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-07-08 11:56:59 +00:00
Ernest Hysa
5e9b415bd9
* fix(search): pin DNS-validated fetch connections Rebase the DNS-rebinding SSRF fix onto current dev after search content moved behind the services.search.content canonical module. Integrate the pinned httpcore NetworkBackend/BaseTransport approach with the current size-capped Client.stream fetch path, preserving Host/SNI semantics while forcing TCP connect to the already validated resolved IP. Keep src.search.content as the compatibility wrapper and preserve existing OG-image http(s) behavior; this avoids reintroducing the unrelated scope changes that previously blocked review. Add the explicit httpcore>=1.0,<2.0 requirement used by the public httpcore NetworkBackend and ConnectionPool APIs. * test(search): restore and rebase DNS rebinding regressions Keep the current security regression coverage that the stale PR branch had deleted, including auth-disabled localhost bypass and Ollama cookbook hardening tests. Carry forward the DNS-rebinding coverage for private resolve blocking, pinned TCP connect behavior, Host header preservation, redirect revalidation, and the BaseTransport/public-httpcore static guard. Update redirect tests to mock the current Client.stream-based capped fetch path rather than the older httpx.stream/get path. * test(search): adapt size-cap fetch tests to pinned client stream The DNS-rebinding repair moved _get_public_url from the module-level httpx.stream shortcut to httpx.Client(...).stream(...) so the fetch can use the pinned transport. Keep the existing size-cap test fakes by routing Client.stream through the monkeypatched httpx.stream only when a test has installed that fake; otherwise fall back to a real Client. This fixes the CI failures in tests/test_web_fetch_size_caps.py without touching unrelated upload-handler atomicity behavior, which is already flaky on clean origin/dev. --------- Co-authored-by: Alexandre Teixeira <alexandremagteixeira@gmail.com>
51 lines
1.6 KiB
Plaintext
51 lines
1.6 KiB
Plaintext
fastapi
|
|
uvicorn
|
|
python-multipart
|
|
python-dotenv
|
|
httpx
|
|
httpcore>=1.0,<2.0
|
|
pydantic>=2.13.4
|
|
pydantic-settings>=2.14.1
|
|
SQLAlchemy
|
|
pypdf
|
|
beautifulsoup4
|
|
charset-normalizer
|
|
numpy
|
|
# Vector store + local embeddings for RAG, semantic memory, and tool
|
|
# selection. Used on core agent paths, so installed by default — the app
|
|
# still degrades to keyword fallback if they're ever missing.
|
|
# chromadb-client is the lightweight HTTP client (talks to a standalone
|
|
# ChromaDB service); fastembed runs local ONNX embeddings.
|
|
chromadb-client
|
|
fastembed
|
|
youtube-transcript-api
|
|
# Markdown rendering for research reports (src/visual_report.py).
|
|
# Imported at module-top so it's a hard core dep, not optional.
|
|
markdown
|
|
# HTML sanitizer for rendered research reports (src/visual_report.py). Report
|
|
# content is untrusted (LLM output over crawled pages) and report pages run
|
|
# under a relaxed CSP, so the rendered HTML is allowlist-sanitized.
|
|
nh3
|
|
# Calendar .ics import/export (routes/calendar_routes.py).
|
|
icalendar
|
|
# Recurrence rule expansion for calendar events (routes/calendar_routes.py).
|
|
# Imported directly as dateutil.rrule — make it explicit even though caldav
|
|
# pulls it in transitively.
|
|
python-dateutil
|
|
# CalDAV sync (src/caldav_sync.py). Handles PROPFIND discovery + REPORT
|
|
# fetch across Radicale, Nextcloud, Apple, Fastmail; we'd be reinventing
|
|
# the protocol without it.
|
|
caldav
|
|
cryptography
|
|
bcrypt
|
|
mcp
|
|
pyotp
|
|
qrcode[pil]
|
|
croniter
|
|
pytest
|
|
pytest-asyncio
|
|
# starlette.testclient prefers httpx2 since Starlette 1.2.0 and warns on every
|
|
# TestClient import when only classic httpx is present. Runtime code keeps
|
|
# using `httpx` above; this is test-client only.
|
|
httpx2
|