WIP: Secure and bound remote image downloads #4

Closed

clawlter wants to merge 4 commits from audit/secure-bounded-downloads into main

clawlter commented

2026-07-12 13:45:38 -04:00

Owner

Draft remediation for bounded, policy-enforced remote still-image downloads.

This follow-up closes malformed WebP, animation-declared VP8X WebP, and SVG style-content validation gaps while preserving approved static image paths.

Verification:

python3 -m pytest -q (34 passed)
python3 -m compileall -q scripts tests
git diff --check
signed commits verified with git log --show-signature
make build reaches generation but remains blocked by the known bentrumanforcongress.com DNS failure

Draft remediation for bounded, policy-enforced remote still-image downloads. This follow-up closes malformed WebP, animation-declared VP8X WebP, and SVG style-content validation gaps while preserving approved static image paths. Verification: - `python3 -m pytest -q` (34 passed) - `python3 -m compileall -q scripts tests` - `git diff --check` - signed commits verified with `git log --show-signature` - `make build` reaches generation but remains blocked by the known `bentrumanforcongress.com` DNS failure

clawlter added 2 commits

2026-07-12 13:45:38 -04:00

fix: secure and bound remote image downloads 982d062ae4

fix: harden still image validation

Booklet CI / Validate and build booklet PDFs (pull_request) Failing after 11m29s

Details

f0fb177426

clawlter added 1 commit

2026-07-12 14:13:27 -04:00

fix: reject animated WebP declarations

Booklet CI / Validate and build booklet PDFs (pull_request) Failing after 7m27s

Details