0656ec62a4
security hardening: F-002/F-005/F-007/F-008/F-009/F-010/F-016/F-031/F-035/F-038/PR747-NEW-2
2026-05-07 16:32:26 +01:00
3fdae8f334
fix #623 #621 #605 #638 #589 #586 #593 : kimi thinking, manifest, inline comments, query boost, cache race, markdownify, content hash
...
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-01 22:15:24 +01:00
74cb9ce197
Security: fix YAML injection in ingest.py, </script> injection in export.py, bound collision loop
...
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-10 16:07:51 +01:00
cf5d721bee
Add video/audio corpus support with yt-dlp download and Whisper transcription
...
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-10 15:40:18 +01:00
808cd98395
Fix YAML injection in webpage title and query frontmatter
2026-04-06 22:35:19 +01:00
c529e2217f
Fix 8 bugs: SSRF in tweet fetch, Cypher injection, XSS in community labels, graph_diff edge ordering, cache key collision, hook uninstall correctness, watch mode set, rebuild word count
2026-04-06 22:23:55 +01:00
d8b1e82079
fix: 5 skill gaps - graphml usage, manifest timing, graph existence checks, no-viz clarity
...
- Add --graphml to Usage table (was implemented but undocumented there)
- Remove early manifest save from --update merge step (Step 9 owns it; saving early meant failed pipelines left manifest ahead of graph)
- query/path/explain now check graph.json exists before running, with clear "run /graphify first" message
- --no-viz: clarify it skips both Obsidian vault and HTML (was contradictory)
2026-04-06 16:06:31 +01:00
5db8f7ce39
docs: update surprising connections description, test count
...
style: replace all em dashes with hyphens
fix: explain hidden .graphify/ folder in skill output and README
fix: rename .graphify/ to graphify-out/ so output is visible by default
2026-04-06 16:06:31 +01:00
41e4e3576a
security: SSRF protection, HTML escaping, path guards, encoding hardening
...
- graphify/security.py (new): centralised security module
- validate_url(): blocks file://, ftp://, data:, any non-http/https scheme
- _NoFileRedirectHandler: re-validates redirect targets, blocks file:// redirects
- safe_fetch(): streams response, 50MB hard cap, non-2xx raises, timeout
- safe_fetch_text(): safe_fetch + UTF-8 decode with errors=replace
- validate_graph_path(): resolves path, requires inside .graphify/, base must exist
- sanitize_label(): strip control chars, cap 256, html.escape() — mirrors
code-review-graph's _sanitize_name pattern
- graphify/ingest.py: _fetch_html() and _download_binary() now use safe_fetch*;
ingest() validates URL scheme and wraps network calls in try/except;
YAML frontmatter: newlines stripped from question before embedding
- graphify/extract.py: all 33 bare .decode() → .decode("utf-8", errors="replace")
— non-UTF-8 source files degrade gracefully instead of crashing extraction
- graphify/export.py: sanitize_label() on all node labels and edge titles
before pyvis embeds them in HTML output
- graphify/serve.py: _load_graph() validates graph_path via validate_graph_path()
and wraps JSONDecodeError with recovery message; sanitize_label() on MCP
text output
- graphify/detect.py: os.walk(..., followlinks=False) made explicit
- SECURITY.md (new): threat model, mitigations table, reporting process
- tests/test_security.py (new): 20 tests covering all security.py functions
2026-04-04 18:56:38 +01:00
e7a03a0539
feat: cache, multi-language extraction, MCP, memory feedback
...
call-graph INFERRED edges, multi-language semantic extraction, SHA256 cache,
MCP stdio server with shortest_path, Q&A memory feedback loop
2026-04-04 18:56:38 +01:00
ce47198be1
feat: Claude Code skill, Obsidian vault, install, tests
...
skill.md with full pipeline steps, Obsidian as default output (canvas, tags,
dataview, graph colors), two-command install, 71 tests, .gitignore, deps
2026-04-04 18:53:43 +01:00
Safi