feat: security, config, and documentation improvements#46
Merged
Conversation
- Security: path traversal guards in files and artifacts routes; session_id validation in JSON store and API (SessionIdPath); Content-Disposition filename sanitization; doc notes for WebSocket API key, executor isolation, health endpoint - Config: single source (deps use config.get_settings); require_api_key and max_upload_mb; API version from package; Dockerfile version 0.8.4 - Upload: enforce DSAGENT_MAX_UPLOAD_MB in files upload - Tests: fix delete_session_not_found mock; API key fixture use config cache - Docs: README CLI/Docker; CLI serve & skills; configuration DSAGENT_*; HTTP API base /api, files/artifacts, full endpoint list; Docker PORT and env; quickstart/index version-agnostic Co-authored-by: Cursor <cursoragent@cursor.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
- files: _get_session_path now resolves path and ensures it is under session_manager.workspace_path before use - artifacts: add _ensure_artifacts_path_under_workspace; use it in list_artifacts, download_artifact, delete_artifact before using session.artifacts_path - Addresses GitHub Advanced Security 'Uncontrolled data used in path expression' review comments on PR #46 Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements the improvements from the plan (docs/PLAN_MEJORAS_E_ISSUES.md) and brings documentation up to date.
Security & robustness
download_file/delete_file(files) anddownload_artifact/delete_artifact(artifacts) now resolve paths and ensure they stay under the session base; filename uses basename only.session_idvalidated (alphanumeric, underscore, hyphen); resolved path checked understorage_dir.session_idpath parameter validated viaSessionIdPath(pattern[a-zA-Z0-9_-]+) on all relevant routes (sessions, files, artifacts, chat, kernel, hitl, websocket).Configuration
dsagent.config.get_settings()(deps no longer define their ownServerSettings).DSAGENT_REQUIRE_API_KEY(refuse start without API key),DSAGENT_MAX_UPLOAD_MB(default 50; 0 = no limit).require_api_keyis true and no API key is set, server raises at startup.__version__; DockerfileLABEL versionset to 0.8.4.Upload limits
DSAGENT_MAX_UPLOAD_MBper file (chunked read, 413 when exceeded).Tests
test_delete_session_not_found: mockload_session.return_value = None(matches handler).dsagent.config.clear_settings_cache()instead ofdeps.get_settings.cache_clear().Documentation
/api(no v1); full route table; files/artifacts usecategory; session export/notebook; all URLs fixed.Related
Addresses the scope of the GitHub issues created from the plan (path traversal, session_id validation, config unification, API version, Dockerfile version, upload limits, Content-Disposition, documentation).
Made with Cursor