pax ad6f876f40 category_fetcher: reject XML responses with DOCTYPE/ENTITY declarations ...

User-configurable sites could send XXE or billion-laughs payloads
via tag category API responses. Reject any XML body containing
<!DOCTYPE or <!ENTITY before passing to ET.fromstring.

2026-04-12 14:55:30 -05:00

..

api

category_fetcher: reject XML responses with DOCTYPE/ENTITY declarations

2026-04-12 14:55:30 -05:00

__init__.py

core/__init__.py: drop stale core.images reference from docstring

2026-04-11 17:28:57 -05:00

cache.py

cache: single-pass directory walk in eviction functions

2026-04-11 23:01:44 -05:00

concurrency.py

Route async work through one persistent loop, lock shared httpx + DB writes

2026-04-07 17:24:23 -05:00

config.py

security: fix #7 — reject Windows reserved device names in template

2026-04-11 16:20:27 -05:00

db.py

db: escape LIKE wildcards in search_library_meta

2026-04-11 19:28:59 -05:00

library_save.py

library_save: ensure categories before template render

2026-04-09 19:18:13 -05:00