AI-Cognitive-Leap/agnes-the-ai-analyst
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
agnes-the-ai-analyst/app/api
History
ZdenekSrotyr 535b5fb1bf security: strip VIRTUAL_ENV/PYTHONPATH from script sandbox and block httpx 
Replace inherited env vars with a minimal env dict (PATH, DATA_DIR, HOME only),
omitting VIRTUAL_ENV and PYTHONPATH to prevent subprocess access to installed
packages. Switch subprocess invocation to sys.executable so the correct
interpreter is used with the restricted PATH. Add httpx to blocked_patterns
and BLOCKED_MODULES. Add test_sandbox_cannot_import_httpx to test_security.py.
2026-04-09 06:58:26 +02:00
..
__init__.py feat: add FastAPI server with auth, RBAC, and all API endpoints 2026-03-27 15:19:18 +01:00
access_requests.py feat: access request UI — catalog badges, request modal, admin approval page 2026-03-31 12:45:29 +02:00
admin.py fix: reject empty table name in register-table endpoint 2026-03-31 12:18:58 +02:00
catalog.py feat: dynamic login providers + profiler auto-trigger + refresh endpoint 2026-04-08 07:04:40 +02:00
data.py feat: implement data access control — table-level permissions 2026-03-31 12:33:31 +02:00
health.py fix: handle timezone-naive timestamps in health check 2026-03-30 14:19:40 +02:00
jira_webhooks.py chore: Docker prod config (Python 3.13, no reload), fix utcnow deprecation, update docs 2026-04-08 12:10:47 +02:00
memory.py feat: complete system — web UI, all API endpoints, governance, admin, CLI commands 2026-03-27 16:52:22 +01:00
permissions.py feat: implement data access control — table-level permissions 2026-03-31 12:33:31 +02:00
query.py security: harden query endpoint SQL blocklist and disable external access 2026-04-09 06:54:58 +02:00
scripts.py security: strip VIRTUAL_ENV/PYTHONPATH from script sandbox and block httpx 2026-04-09 06:58:26 +02:00
settings.py feat: add dataset permissions, script execution, Kamal config, CI/CD 2026-03-27 15:40:11 +01:00
sync.py feat: dynamic login providers + profiler auto-trigger + refresh endpoint 2026-04-08 07:04:40 +02:00
telegram.py feat: complete system — web UI, all API endpoints, governance, admin, CLI commands 2026-03-27 16:52:22 +01:00
upload.py security: harden query (read-only DB), uploads (path sanitization), scripts (AST validation) 2026-04-08 12:09:19 +02:00
users.py feat: add FastAPI server with auth, RBAC, and all API endpoints 2026-03-27 15:19:18 +01:00