russell@unturf.com
f3815eb0ce
- views/__init__.py: add MAX_CONTENT_LENGTH = 500_000 (shared constant with comment explaining the CWE-407 / bleach ReDoS rationale) - reply_node.py: reject oversized content before set_data() / clean_raw_html() - modify_node.py: same guard on edit path - new_thread.py: same guard on new thread path - requirements.py3.txt: tighten bleach>=2.1.4 -> bleach>=6.0.0 with CVE note - test_render.py: unit tests for bleach version contract, API stability, sanitization correctness, and ReDoS resistance timing - test_views.py: functional tests for content length enforcement on all three browser form paths (reply, new thread)
77 lines
1.7 KiB
Text
77 lines
1.7 KiB
Text
# python 2 -> 3 compat.
|
|
six
|
|
|
|
# Python 3.12+ no longer bundles setuptools in venvs.
|
|
setuptools
|
|
|
|
# Pyramid.
|
|
plaster_pastedeploy
|
|
pyramid
|
|
pyramid_jinja2
|
|
pyramid_debugtoolbar
|
|
pyramid_retry
|
|
pyramid_tm
|
|
|
|
# Model.
|
|
SQLAlchemy
|
|
SQLAlchemy-Utils
|
|
transaction
|
|
zope.sqlalchemy
|
|
alembic
|
|
|
|
# PostgreSQL database connections.
|
|
# requires postgresql-devel on Fedora for `pg_config` binary.
|
|
psycopg2-binary
|
|
|
|
# Template renderer.
|
|
#jinja2
|
|
jinja2
|
|
|
|
# MarkDown is a popular and familair WYSIWYM markup language.
|
|
markdown
|
|
python-markdown-math
|
|
html5lib
|
|
BeautifulSoup4
|
|
|
|
# Bleach sanitizes MarkDown (removes HTML/Javascript) to prevent XSS.
|
|
# Pin >=6.0.0: bleach <3.3.0 had CVE-2021-23980 (ReDoS in linkifier URL regex);
|
|
# bleach <6.0.0 had LinkifyFilter API differences that break sanitize_html.py.
|
|
bleach>=6.0.0
|
|
bleach-allowlist
|
|
|
|
# codehilite.
|
|
pygments
|
|
|
|
# Human readable time deltas.
|
|
ago
|
|
|
|
# light weight URI attribute parser.
|
|
miniuri
|
|
|
|
# the official Remarkbox "meta" theme.
|
|
remarkbox-theme-meta @ git+ssh://git@git.unturf.com:2222/engineering/remarkbox/remarkbox-theme-meta.git
|
|
|
|
# another example theme.
|
|
#git+https://github.com/russellballestrini/remarkbox-westworld.git#egg-remarkbox-westworld
|
|
#git+https://git.unturf.com/engineering/remarkbox/remarkbox-westworld.git#egg-remarkbox-westworld
|
|
#remarkbox-westworld @ git+https://git.unturf.com/engineering/remarkbox/remarkbox-westworld.git
|
|
|
|
# Create URI slugs from titles.
|
|
python-slugify
|
|
|
|
# Future proof, computationally complex password hashes.
|
|
bcrypt
|
|
|
|
# reach out to verify public rb_owner_key.
|
|
requests[security]
|
|
# request library pins this dependency too low.
|
|
# idna==2.6
|
|
|
|
# credit card storage and processing.
|
|
stripe
|
|
|
|
# slack: bot notifications.
|
|
slacker
|
|
|
|
# DKIM Signed Email from Python.
|
|
dkimpy
|