f843270aab
Merge pull request 'fix: disable auto-redirects to prevent SSRF ( #3 )' ( #15 ) from fix/issue-3 into main
...
CI / lint (push) Waiting to run
CI / test (push) Waiting to run
CI / docker-build (push) Waiting to run
CI / security (push) Waiting to run
CI / build-result (push) Blocked by required conditions
Reviewed-on: https://git.example.com/jarianc/NASAImageDownloader/pulls/15
2026-07-05 02:50:51 -05:00
5c23a347ad
Merge pull request 'fix: validate --output path to prevent arbitrary file write ( #2 )' ( #14 ) from fix/issue-2 into main
...
Reviewed-on: https://git.example.com/jarianc/NASAImageDownloader/pulls/14
2026-07-05 02:50:29 -05:00
e692423da2
Merge pull request 'fix: sanitize filenames to prevent path traversal ( #1 )' ( #13 ) from fix/issue-1 into main
...
Reviewed-on: https://git.example.com/jarianc/NASAImageDownloader/pulls/13
2026-07-05 02:50:07 -05:00
fdc66efe1b
fix: disable auto-redirects and validate URLs to prevent SSRF ( #3 )
...
- Add _is_safe_url() checking for private/loopback/link-local/reserved IPs
- Block internal hostnames (.local, .internal, localhost, metadata.google.internal)
- Disable allow_redirects in requests.get()
- Validate redirect target before following single hop
- Raise RuntimeError on unsafe URL or redirect
2026-07-05 07:44:27 +00:00
69dfdce4f5
fix: validate --output path to prevent arbitrary file write ( #2 )
...
- Block system-critical paths (/etc, /usr, /bin, /sbin, /boot, /dev, /proc, /sys, /)
- Resolve path before validation to defeat symlink tricks
- Exit with error message if blocked path detected
2026-07-05 07:43:52 +00:00
668f48897f
fix: sanitize nasa_id and filenames to prevent path traversal ( #1 )
...
- Add sanitize_filename() to strip path separators and parent refs
- Apply sanitization to nasa_id used in metadata filenames
- Apply sanitization to image filenames derived from asset_href
- Preserve raw nasa_id for API calls to avoid breaking asset lookup
2026-07-05 07:43:07 +00:00
8e7f5bc920
Merge pull request 'CI: remove --no-cache for docker layer caching' ( #12 ) from ci-fix-nocache into main
...
Reviewed-on: https://git.example.com/jarianc/NASAImageDownloader/pulls/12
2026-07-04 22:23:17 -05:00
a54d57a7c7
CI: remove --no-cache for docker layer caching
2026-07-05 03:13:09 +00:00
5acbf697fa
CI: add generalized workflow
2026-07-05 02:46:34 +00:00
3b0fea6379
4 hours instead of 2. Will expose a cli param for Max Run time later
2025-10-19 21:23:36 -05:00
65623e486f
added requirements.txt
2025-09-11 21:03:24 -05:00
b0e5bd273c
Getting rid of last_run.txt from the repo (untracking)
2025-09-11 20:54:06 -05:00
2e0bcb845c
Readme fix
2025-09-11 00:09:19 -05:00
556006d8c6
Added a Readme and License file
2025-09-11 00:08:11 -05:00
687513725c
Adding output dir as script input
2025-09-10 23:39:31 -05:00
41d7a6848e
Downloader up and working
2025-09-10 23:27:33 -05:00
