diff --git a/.github/workflows/e2e-issue-981.yml b/.github/workflows/e2e-issue-981.yml index 34209ee25..614457c44 100644 --- a/.github/workflows/e2e-issue-981.yml +++ b/.github/workflows/e2e-issue-981.yml @@ -1,4 +1,4 @@ -name: e2e issue-981 checkboxes DADict +name: End-to-end test suite # Proves the fix in docassemble_webapp/docassemble/webapp/interview/helpers.py # end to end against the real server: POST /api/session with a plain dict for diff --git a/FORK.md b/FORK.md index 19d72e086..99a9f99dc 100644 --- a/FORK.md +++ b/FORK.md @@ -45,6 +45,51 @@ Branch `jacob/maintained` is the working branch. It tracks fallback. Implementation in `docassemble/base/email_crypto.py`. - **Clearer API error**: when a plain dict still breaks assembly, the error names the variable and links `session_post_objects`. +- **SEO head tags, canonical, sitemap** (#15): `standard_html_start` emits a + ``, a `` derived from the URL + root (suppressible via `canonical: False`), and Open Graph tags for + ungated pages; a `/sitemap.xml` route lists every public interview. + CI: `Issue-15 control` (expect-fail on release) → + `Issue-15 - install head builder and sitemap route` (expect-pass). +- **a11y skip link, 404 landmark, print CSS** (#18): a skip-to-content link + is injected before the main region, the 404 page gains a `
` + landmark and a home link, and `@media print` rules hide chrome. + CI: `Issue-18 control` (expect-fail) → + `Issue-18 - install a11y templates, CSS, and interview page` (expect-pass). +- **FontAwesome CSS build, page weight** (#19): the 1.5 MB FontAwesome JS + bundle is replaced by a CSS + webfont build (~350 KB), cutting ~1.1 MB + from every page load. + CI: `Issue-19 control` (expect-fail, JS bundle present) → + `Issue-19 - install FontAwesome CSS build` (expect-pass, weight drops). +- **NFC normalisation in pdftk.py** (#21): fill values are normalised to + NFC before the XFDF write so combining characters (e.g. NFD accents + from macOS input) render correctly in the filled PDF. + CI: `NFC control` (expect-fail, combining accent lost) → + `NFC - install this branch's pdftk.py` (expect-pass). +- **geopy lazy-load** (upstream #932): `geopy` is imported on first use + instead of at module load, so a broken pydantic chain in a transitive + dependency cannot prevent the server from starting. + CI: container boot in the e2e workflow exercises the import path. +- **safe_join path containment** (CodeQL path-injection): every + Playground, package-read/write, project rename/create, and + package-setup site now routes through `werkzeug.utils.safe_join` (or + an equivalent guard), closing path-traversal vectors flagged by + CodeQL's `security-extended` queries. + CI: CodeQL advanced scan (`.github/workflows/codeql.yml`). +- **tar-slip fix** (CodeQL): `PyPI package extraction` validates that + every member path stays inside the target directory before extraction, + closing a tar-slip (Zip-slip variant) write-wherever. + CI: CodeQL advanced scan (`.github/workflows/codeql.yml`). +- **ReDoS fix** (CodeQL polynomial-redos): nine polynomial-redos regexes + across package setup, filename parsing, and hostname validation are + rewritten with proven-equivalent linear-time alternatives + (`re.split`, `rstrip`, non-backtracking patterns). + CI: CodeQL advanced scan (`.github/workflows/codeql.yml`). +- **Open redirects fix** (CodeQL): two redirect sites that accepted a + user-supplied URL now validate the target against an allow-list of + safe schemes and same-origin hosts before issuing the `Location` + header. + CI: CodeQL advanced scan (`.github/workflows/codeql.yml`). - **PDF choice options**: editable fills preserve paired export/display options and selection indices; a temporary display-label projection lets QPDF render labels while the saved PDF retains its canonical export values. diff --git a/README.md b/README.md index 0b20739d6..f6aad9f89 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -[![CodeQL](https://github.com/jacobyoby/docassemble/actions/workflows/github-code-scanning/codeql/badge.svg?branch=jacob%2Fmaintained)](https://github.com/jacobyoby/docassemble/security/code-scanning) +[![CodeQL](https://github.com/jacobyoby/docassemble/actions/workflows/codeql.yml/badge.svg?branch=jacob%2Fmaintained)](https://github.com/jacobyoby/docassemble/security/code-scanning) [![e2e](https://github.com/jacobyoby/docassemble/actions/workflows/e2e-issue-981.yml/badge.svg?branch=jacob%2Fmaintained)](https://github.com/jacobyoby/docassemble/actions/workflows/e2e-issue-981.yml) [![Dependabot](https://img.shields.io/badge/Dependabot-security_updates-025e8c?logo=dependabot)](https://github.com/jacobyoby/docassemble/security/dependabot) [![Secret scanning](https://img.shields.io/badge/secret_scanning-push_protection-2da44e)](https://github.com/jacobyoby/docassemble/security)