fix: close SVG sanitization gap on upload routes and fix OCR/extension bugs

Security:
- Apply sanitizeSvg() to all file upload routes (files.ts, user-files.ts)
  preventing SSRF and script injection via SVG uploads to file library

Functional:
- Handle PaddleOCR-VL 1.5 markdown_texts output format in ocr.py
- Add empty-text fallback in OCR tier chain (ocr.ts) so higher tiers
  that return empty text fall back to the next tier automatically
- Fix SVG->PNG filename extension mismatch in tool-factory.ts so
  download endpoint serves correct Content-Type
- Report original upload size (not decoded size) in API response

Test infrastructure:
- Move Playwright auth state from test-results/ to .playwright/ to
  prevent mid-run cleanup deleting auth files
- Fix auth.setup.ts navigation race with waitForURL
- Fix gui-batch.spec.ts regex matching "Presets" instead of "reset"
- Fix pipeline-advanced.spec.ts crop bounds and resize assertions
- Broaden pipeline cleanup to include all E2E-prefixed pipelines
This commit is contained in:
SnapOtter
2026-04-30 16:11:33 +08:00
parent fc8b549d78
commit b00ef20667
13 changed files with 77 additions and 18 deletions
+2 -2
View File
@@ -375,7 +375,7 @@ test.describe("Deep pipelines (6+ steps)", () => {
steps: [
{ toolId: "strip-metadata", settings: {} },
{ toolId: "rotate", settings: { angle: 90 } },
{ toolId: "resize", settings: { width: 800, fit: "contain" } },
{ toolId: "resize", settings: { width: 400, fit: "contain" } },
{ toolId: "adjust-colors", settings: { brightness: 5, contrast: 10, saturation: -5 } },
{ toolId: "sharpening", settings: { sigma: 1.0 } },
{
@@ -434,7 +434,7 @@ test.describe("Workflow: e-commerce product pipeline", () => {
file: { name: "sample.jpg", mimeType: "image/jpeg", buffer: JPG_SAMPLE },
pipeline: JSON.stringify({
steps: [
{ toolId: "crop", settings: { left: 50, top: 50, width: 400, height: 400 } },
{ toolId: "crop", settings: { left: 50, top: 50, width: 400, height: 350 } },
{ toolId: "resize", settings: { width: 800, height: 800, fit: "contain" } },
{ toolId: "image-enhancement", settings: { preset: "vivid" } },
{