From 472cdada35f34ae71d054d73eb4286e1d932e7c3 Mon Sep 17 00:00:00 2001 From: jacobyoby Date: Tue, 8 Sep 2026 23:24:51 -0700 Subject: [PATCH] docs: update FORK.md with post-e774a7fdb divergences, fix CodeQL badge, rename e2e workflow (#27) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Add 9 bullets to FORK.md covering SEO (#15), a11y (#18), FontAwesome CSS (#19), NFC normalisation (#21), geopy lazy-load (#932), safe_join path containment, tar-slip, ReDoS, and open-redirect fixes — each with the CI step that proves it - Fix CodeQL badge URL: default-setup slug → advanced workflow file (.github/workflows/codeql.yml) - Rename e2e workflow from "e2e issue-981 checkboxes DADict" to "End-to-end test suite" --- .github/workflows/e2e-issue-981.yml | 2 +- FORK.md | 45 +++++++++++++++++++++++++++++ README.md | 2 +- 3 files changed, 47 insertions(+), 2 deletions(-) diff --git a/.github/workflows/e2e-issue-981.yml b/.github/workflows/e2e-issue-981.yml index 15869bc41..47a8b3ffe 100644 --- a/.github/workflows/e2e-issue-981.yml +++ b/.github/workflows/e2e-issue-981.yml @@ -1,4 +1,4 @@ -name: e2e issue-981 checkboxes DADict +name: End-to-end test suite # Proves the fix in docassemble_webapp/docassemble/webapp/interview/helpers.py # end to end against the real server: POST /api/session with a plain dict for diff --git a/FORK.md b/FORK.md index 990ae89c9..35740f630 100644 --- a/FORK.md +++ b/FORK.md @@ -45,6 +45,51 @@ Branch `jacob/maintained` is the working branch. It tracks fallback. Implementation in `docassemble/base/email_crypto.py`. - **Clearer API error**: when a plain dict still breaks assembly, the error names the variable and links `session_post_objects`. +- **SEO head tags, canonical, sitemap** (#15): `standard_html_start` emits a + ``, a `` derived from the URL + root (suppressible via `canonical: False`), and Open Graph tags for + ungated pages; a `/sitemap.xml` route lists every public interview. + CI: `Issue-15 control` (expect-fail on release) → + `Issue-15 - install head builder and sitemap route` (expect-pass). +- **a11y skip link, 404 landmark, print CSS** (#18): a skip-to-content link + is injected before the main region, the 404 page gains a `
` + landmark and a home link, and `@media print` rules hide chrome. + CI: `Issue-18 control` (expect-fail) → + `Issue-18 - install a11y templates, CSS, and interview page` (expect-pass). +- **FontAwesome CSS build, page weight** (#19): the 1.5 MB FontAwesome JS + bundle is replaced by a CSS + webfont build (~350 KB), cutting ~1.1 MB + from every page load. + CI: `Issue-19 control` (expect-fail, JS bundle present) → + `Issue-19 - install FontAwesome CSS build` (expect-pass, weight drops). +- **NFC normalisation in pdftk.py** (#21): fill values are normalised to + NFC before the XFDF write so combining characters (e.g. NFD accents + from macOS input) render correctly in the filled PDF. + CI: `NFC control` (expect-fail, combining accent lost) → + `NFC - install this branch's pdftk.py` (expect-pass). +- **geopy lazy-load** (upstream #932): `geopy` is imported on first use + instead of at module load, so a broken pydantic chain in a transitive + dependency cannot prevent the server from starting. + CI: container boot in the e2e workflow exercises the import path. +- **safe_join path containment** (CodeQL path-injection): every + Playground, package-read/write, project rename/create, and + package-setup site now routes through `werkzeug.utils.safe_join` (or + an equivalent guard), closing path-traversal vectors flagged by + CodeQL's `security-extended` queries. + CI: CodeQL advanced scan (`.github/workflows/codeql.yml`). +- **tar-slip fix** (CodeQL): `PyPI package extraction` validates that + every member path stays inside the target directory before extraction, + closing a tar-slip (Zip-slip variant) write-wherever. + CI: CodeQL advanced scan (`.github/workflows/codeql.yml`). +- **ReDoS fix** (CodeQL polynomial-redos): nine polynomial-redos regexes + across package setup, filename parsing, and hostname validation are + rewritten with proven-equivalent linear-time alternatives + (`re.split`, `rstrip`, non-backtracking patterns). + CI: CodeQL advanced scan (`.github/workflows/codeql.yml`). +- **Open redirects fix** (CodeQL): two redirect sites that accepted a + user-supplied URL now validate the target against an allow-list of + safe schemes and same-origin hosts before issuing the `Location` + header. + CI: CodeQL advanced scan (`.github/workflows/codeql.yml`). ## Test harness (`.github/workflows/`) diff --git a/README.md b/README.md index 0b20739d6..f6aad9f89 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -[![CodeQL](https://github.com/jacobyoby/docassemble/actions/workflows/github-code-scanning/codeql/badge.svg?branch=jacob%2Fmaintained)](https://github.com/jacobyoby/docassemble/security/code-scanning) +[![CodeQL](https://github.com/jacobyoby/docassemble/actions/workflows/codeql.yml/badge.svg?branch=jacob%2Fmaintained)](https://github.com/jacobyoby/docassemble/security/code-scanning) [![e2e](https://github.com/jacobyoby/docassemble/actions/workflows/e2e-issue-981.yml/badge.svg?branch=jacob%2Fmaintained)](https://github.com/jacobyoby/docassemble/actions/workflows/e2e-issue-981.yml) [![Dependabot](https://img.shields.io/badge/Dependabot-security_updates-025e8c?logo=dependabot)](https://github.com/jacobyoby/docassemble/security/dependabot) [![Secret scanning](https://img.shields.io/badge/secret_scanning-push_protection-2da44e)](https://github.com/jacobyoby/docassemble/security)