kenzuya/unshackle
1
0
Fork 2
mirror of https://github.com/unshackle-dl/unshackle.git synced 2026-11-13 12:35:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(remote): harden serve API access control and input handling

Browse Source 
Bind sessions and download jobs to the API key (not source IP), reject path-traversal cache keys, bound decompression of peer-supplied blobs, gate the CDM device before the vault fallback, and compare API keys in constant time.
This commit is contained in:
imSp4rky
2026-07-06 23:54:05 -06:00
parent 84d9b92530
commit 5cd50544a8
8 changed files with 121 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/remote/unit/test_errors.py
+1
View File
@@ -32,6 +32,7 @@ def test_api_error_default_http_status_per_code() -> None:
APIErrorCode.JOB_NOT_FOUND: 404,
APIErrorCode.SESSION_NOT_FOUND: 404,
APIErrorCode.TRACK_NOT_FOUND: 404,
APIErrorCode.CONFLICT: 409,
APIErrorCode.RATE_LIMITED: 429,
APIErrorCode.INTERNAL_ERROR: 500,
APIErrorCode.DOWNLOAD_ERROR: 500,