mirror of
https://github.com/guillaumemeyer/watermarks-remover.git
synced 2026-08-22 13:11:57 +02:00
Guillaume Meyer (The Opinionated Man)
fa81cbc23a
Security hardening from deep assessment: - Writes: atomic temp+rename via safe_write_bytes/text (no symlink following, no partial in-place loss); backup_path for --in-place; umask-default modes; symlink destinations refused. - rewrite_text: refuse redirects (no Authorization/key re-send to unvalidated hosts), default-deny loopback allowlist with explicit --allow-remote / WATERMARKS_REWRITE_ALLOW_REMOTE opt-in, http(s)-only schemes, --api-key argv flag removed (env-only). - CI: SHA-pin actions (checkout v7.0.1, setup-python v7.0.0, codeql), permissions: contents: read, pinned requirements-dev.txt, pip-audit step; new CodeQL workflow. - Scorer deps: bump Pillow 10.4.0 -> 12.3.0 (24 known CVEs); pip pinned in Dockerfile and setup_synthid.sh; Docker runs as unprivileged user. - Resource caps: MAX_INPUT_BYTES 1GiB -> 256MiB, 64MiB stdin cap, zip budget 512MiB -> 128MiB, RLIMIT_AS/FSIZE on child processes. - Tests: 18 new security regression tests (60 total, all passing).
29 lines
715 B
YAML
29 lines
715 B
YAML
name: CodeQL
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
schedule:
|
|
- cron: "23 3 * * 1"
|
|
|
|
permissions:
|
|
contents: read
|
|
# Required for CodeQL to upload SARIF results.
|
|
security-events: write
|
|
|
|
jobs:
|
|
analyze:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
language: [python]
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- uses: github/codeql-action/init@c16c0f3f2812ec4bb3750a5ed64873fe2ce0fbef # codeql-bundle-v2.26.3
|
|
with:
|
|
languages: ${{ matrix.language }}
|
|
- uses: github/codeql-action/analyze@c16c0f3f2812ec4bb3750a5ed64873fe2ce0fbef # codeql-bundle-v2.26.3
|