lichenblankie/tinyweb
2
0
Fork 0
Code Issues Pull requests Projects 1 Releases Packages Wiki Activity Actions
No description
16 commits 2 branches 0 tags 10 MiB
Find a file
Derick Phan 1fbbadd9f4 Fix SSRF redirect bypass, identity permissions, error leakage, and DB connection leaks 
- SSRF: disable automatic redirects, manually follow up to 5 hops with
  IP re-validation at each step to prevent redirect-to-localhost bypass
- Identity file: enforce 0600 permissions on tinyweb_identity at load
  and creation to prevent other users from reading the private key
- Error messages: replace raw exception strings with generic messages
  to avoid leaking internal paths/hostnames to the UI
- DB connections: wrap all get_db() usage in try/finally to guarantee
  close() even when handlers throw mid-operation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-06-05 04:57:54 +00:00
themes Add themes folder with kodama template and gitignore index.db 2026-06-05 04:57:54 +00:00
.gitignore Add themes folder with kodama template and gitignore index.db 2026-06-05 04:57:54 +00:00
app.py Fix SSRF redirect bypass, identity permissions, error leakage, and DB connection leaks 2026-06-05 04:57:54 +00:00
CLAUDE.md Add CLAUDE.md with project architecture and conventions 2026-06-05 04:57:54 +00:00
db.py Fix SSRF redirect bypass, identity permissions, error leakage, and DB connection leaks 2026-06-05 04:57:54 +00:00
gateway.py Harden security: bookmark auth, CSP headers, per-session CSRF, and more 2026-06-05 04:57:54 +00:00
handlers.py Fix SSRF redirect bypass, identity permissions, error leakage, and DB connection leaks 2026-06-05 04:57:54 +00:00
README.md first commit 2026-06-05 04:57:53 +00:00
requirements.txt Migrate TinyWeb to Reticulum mesh network 2026-06-05 04:57:53 +00:00
rns_client.py Add Reticulum-native subscriptions and sync-based distributed search 2026-06-05 04:57:53 +00:00
templates.py Add custom HTML template editor and clean up UI 2026-06-05 04:57:54 +00:00

README.md