4 Commits

Author	SHA1	Message	Date
Safi	6695f0aefd	fix: security hardening, dedup correctness, and large-graph support ... - security.py: replace global socket.getaddrinfo monkey-patch with per-connection _SSRFGuardedHTTPConnection/HTTPSConnection subclasses (thread-safe, closes TOCTOU) - security.py: add GRAPHIFY_MAX_GRAPH_BYTES env var override for 512MB cap (MB/GB suffix supported); improve cap error message to cite the env var - llm.py: wrap untrusted source files in XML delimiters with sha256 fingerprint; neutralise jailbreak sentinel tokens to mitigate prompt injection - dedup.py: skip code nodes in label-based dedup passes; code symbols now deduplicated by ID only, preventing distinct same-named symbols from merging - extract.py: cross-file calls resolution now consults import evidence before bailing on ambiguous callee names; emits EXTRACTED edges when named import is unambiguous - analyze.py: extend _BUILTIN_NOISE_LABELS with stdlib types and modules - __main__.py: CLAUDE.md template uses MANDATORY language for graphify-first rule; PreToolUse hook message hardened to imperative; graphify export html auto-falls back to community-aggregation view when graph.json exceeds size cap - tests/test_pg_introspect.py: add importorskip guard for tree_sitter_sql Closes #1211, #1210, #1205, #1219, #1227; resolves discussion #1019 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-10 12:45:20 +01:00
Safi	8c1d5e8114	Update SECURITY.md: supported versions, SSRF and YAML injection mitigations	2026-04-06 22:38:02 +01:00
Safi	5db8f7ce39	docs: update surprising connections description, test count ... style: replace all em dashes with hyphens fix: explain hidden .graphify/ folder in skill output and README fix: rename .graphify/ to graphify-out/ so output is visible by default	2026-04-06 16:06:31 +01:00
Safi	41e4e3576a	security: SSRF protection, HTML escaping, path guards, encoding hardening ... - graphify/security.py (new): centralised security module - validate_url(): blocks file://, ftp://, data:, any non-http/https scheme - _NoFileRedirectHandler: re-validates redirect targets, blocks file:// redirects - safe_fetch(): streams response, 50MB hard cap, non-2xx raises, timeout - safe_fetch_text(): safe_fetch + UTF-8 decode with errors=replace - validate_graph_path(): resolves path, requires inside .graphify/, base must exist - sanitize_label(): strip control chars, cap 256, html.escape() — mirrors code-review-graph's _sanitize_name pattern - graphify/ingest.py: _fetch_html() and _download_binary() now use safe_fetch*; ingest() validates URL scheme and wraps network calls in try/except; YAML frontmatter: newlines stripped from question before embedding - graphify/extract.py: all 33 bare .decode() → .decode("utf-8", errors="replace") — non-UTF-8 source files degrade gracefully instead of crashing extraction - graphify/export.py: sanitize_label() on all node labels and edge titles before pyvis embeds them in HTML output - graphify/serve.py: _load_graph() validates graph_path via validate_graph_path() and wraps JSONDecodeError with recovery message; sanitize_label() on MCP text output - graphify/detect.py: os.walk(..., followlinks=False) made explicit - SECURITY.md (new): threat model, mitigations table, reporting process - tests/test_security.py (new): 20 tests covering all security.py functions	2026-04-04 18:56:38 +01:00