chore: repo hygiene and security hardening - #11
Closed
mkultraWasHere wants to merge 8 commits into
Closed
Conversation
- Bump version to 0.5.0 in pyproject.toml (matches README badge) - Update Node requirement to 20+ (matches pdfjs-dist engine) - Remove uv.lock from .gitignore and commit lockfile - Self-host JetBrains Mono font, remove Google Fonts dependency - Fix false privacy claim in README comparison table - Add PDF download button to viewer header - Remove vendored system packages (natbib.sty, fancyhdr.sty) that violate LPPL redistribution terms — TeX Live provides them - Bundle acmart.dtx alongside acmart.cls per LPPL requirements - Add LPPL-1.3c license text and THIRD_PARTY_LICENSES manifest Co-Authored-By: Claude <noreply@anthropic.com>
Block requests to private/loopback/link-local/reserved IPs, validate URL schemes, and catch redirect-based bypasses via aiohttp TraceConfig. Also upgrades the PDF download icon to SVG with white color. Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude <noreply@anthropic.com>
Replaces the upstream command tool with a sandboxed version that blocks network-exfiltration binaries (curl, wget, nc, ssh, etc.) and env-exposure commands. Adds -norc to all latexmk invocations to prevent .latexmkrc Perl code execution from untrusted paper directories. Co-Authored-By: Claude <noreply@anthropic.com>
- Replace trace-based redirect hook with manual redirect following that validates each Location header before connecting - Name downloaded PDFs after the paper title instead of generic paper.pdf - Remove stale fancyhdr.sty/natbib.sty from ICLR/ICML template configs Co-Authored-By: Claude <noreply@anthropic.com>
Subprocesses spawned by the agent command tool inherited the full server environment including API keys. Strip credential-shaped variables (*_API_KEY, *_TOKEN, *_SECRET, *_PASSWORD, *_CREDENTIAL, plus AWS keys and DATABASE_URL) while preserving S2_API_KEY for Semantic Scholar and all non-sensitive vars. Co-Authored-By: Claude <noreply@anthropic.com>
Document the defense-in-depth mitigations (command denylist, env scrubbing, SSRF protection, build isolation) and their limitations. Include recommendations for running against untrusted papers. Co-Authored-By: Claude <noreply@anthropic.com>
mkultraWasHere
requested review from
GangGreenTemperTatum,
GitFlitti,
SJCaldwell,
alpine-1,
beerMT,
briangreunke,
danielvaughn,
monoxgas,
moohax,
mwendigg,
rdheekonda,
t94j0,
thomasqbrady and
vabruzzo
as code owners
August 19, 2026 21:39
Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
sys.argvin validate.sh (was shell-interpolated into Python), add-norcto all latexmk invocationscurl,wget,nc,ssh, etc.), scrub credential-shaped env vars from subprocess environmentsfancyhdr.sty/natbib.styfrom ICLR/ICMLextra_files(broke template switching)Test plan
task test)bash -cbypass blocking (5 formal tests + 28-case stress test)S2_API_KEY, non-sensitive var preservation (4 formal tests + 28-case stress test)🤖 Generated with Claude Code