mirror of
https://github.com/ChuckBuilds/LEDMatrix.git
synced 2026-10-04 14:25:08 +00:00
refactor(web): delete dead routes, JS files and duplicate definitions (#609)
* refactor(web): drop validators nothing calls escape_html, validate_image_url, validate_font_awesome_class, validate_mime_type, validate_numeric_range, validate_string_length and sanitize_plugin_config had no callers outside their own tests. Only validate_file_upload (fonts upload) is imported by the web interface. dedup_unique_arrays is kept: its one caller in save_plugin_config was removed by the unrelated sync PR (#330), which looks accidental. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor(api): remove the music-auth and of-the-day JSON routes POST /plugins/authenticate/spotify and /plugins/authenticate/ytm had no caller but their tests: the music plugin authenticates through its web_ui_actions (authenticate_spotify.py / authenticate_ytm.py) via /plugins/action. POST /plugins/of-the-day/json/upload and /json/delete looked the plugin up by the id ledmatrix-of-the-day (its manifest id is of-the-day), were reachable only from a file_type "json" upload field that no schema declares, and put the plugin directory on sys.path per request to import scripts.update_config. of-the-day manages its files through plugin-file-manager and its own web_ui_actions. The of-the-day branch of GET /plugins/config stays: it matches the real manifest id and still merges the on-disk category files into the form. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor(api): read managers only from the blueprints api_v3/__init__.py and pages_v3.py declared module globals (plugin_store_manager, saved_repositories_manager, schema_manager, operation_queue, plugin_state_manager, operation_history, sync_manager, config_manager, plugin_manager) that nothing assigns: app.py sets the managers as attributes on the Blueprint objects, and every route reads them there. The one reader, backup restore's fallback to the module plugin_store_manager, could only ever fall back to None. _ensure_cache_manager() built a second CacheManager in the web process instead of using the one app.py puts on api_v3. The display routes now read api_v3.cache_manager, creating it on the blueprint only when nothing set it (the same None handling as the /cache routes). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore(web): drop run.sh and the unused log_config_change web_interface/run.sh was referenced only by web_interface/README.md; the service starts the UI through scripts/utils/start_web_conditionally.py and the README already documents `python3 web_interface/start.py`. log_config_change() in web_interface/logging_config.py was never called. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor(web): delete unreferenced store_manager.js, diff_viewer.js, htmx-sse.js - js/plugins/store_manager.js (window.PluginStoreManager) and js/config/diff_viewer.js (window.ConfigDiffViewer) were loaded on every page but nothing reads either global. - htmx-sse.js (plus its CDN fallback) was loaded after HTMX, but no template or plugin page uses sse-connect / hx-ext="sse": the live streams run through LEDStreams in app-shell.js. js/plugins/state_manager.js stays: install_manager.js's updateAll() reads and refreshes window.PluginStateManager. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor(web): remove app.js helpers nothing calls - hexToRgb, rgbToHex, validateForm, uploadFont and switchTab (whose 'switch-tab' event had no listener) have no caller in the templates, static JS or the plugin monorepo. - installPlugin: plugins_manager.js (loaded last) assigns window.installPlugin, and its own store cards are the only callers. - The showNotification fallback could never install: app-shell.js is deferred ahead of app.js and defines the same fallback at top level. - performanceMonitor only logged with ?debug=perf and read an unset this.measures; the marks it took on every load had no reader. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor(web): drop app-shell.js refreshPlugin A top-level function in app-shell.js, so a window global, but nothing calls it (no inline handler, no window lookup, no string-built name). The other plugin actions in that block stay. updatePlugin is the live window.updatePlugin: plugins_manager.js only installs its own copy when none exists. uninstallPlugin/pollUninstallOperation, updateAllPlugins, executePluginAction and toggleNestedSection are replaced by later deferred scripts, but a click that lands while those scripts are still downloading reaches the app-shell copies, so removing them is not a pure no-op. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor(web): remove definitions plugins_manager.js always overrides All of these are replaced before anything can call them, checked against the load order in base.html and the live window.* values: - openOnDemandModal/requestOnDemandStop stubs: the IIFE later in the same script assigns the real functions synchronously. - updatePlugin and uninstallPlugin stubs (`window.X || stub`): app-shell.js already defined both, so the fallback never installed. Same for the later updatePlugin override, gated on the live function containing '[UPDATE]', which app-shell.js's never does. - The first addArrayObjectItem/removeArrayObjectItem: reassigned by the top-level copies after the IIFE. - The first `function formatDate` in the IIFE: a later declaration of the same name in the same scope wins. - deleteUploadedImage, getCurrentImages, showUploadProgress, formatFileSize and getScheduleSummary: character-for-character copies of js/widgets/file-upload.js, which stays the owner. - `typeof X === 'undefined'` fallbacks and `typeof X !== 'undefined'` re-exports after the IIFE: always false, or a self-assignment. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor(web): render the shell directly and delete index.html index.html extended base.html with {% block content %}, but base.html defines no blocks, so none of index.html ever rendered: rendering both with jinja2 gives byte-identical output. index() still loaded the config, read config.json and config_secrets.json raw and json.dumps'd them on every page load for variables base.html never reads, and flashed errors that base.html never shows. It now renders base.html with no context. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(web): stop htmx-config.js replacing console.error and console.warn It swapped both globals for filters that dropped any error mentioning insertBefore / "Cannot read properties of null" when "htmx" appeared in the message or stack, and a list of Permissions-Policy warnings. That hid real errors from every script on the page, and made every logged error and warning report htmx-config.js as its source. The beforeSwap target validation above it, which prevents the insertBefore errors in the first place, stays. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore(web): quiet the widget load announcements and debug logs About 30 lines hit the console on every page load: one "... widget registered" per widget file, one "[WidgetRegistry] Registered widget: X" per registration, plus the registry, base widget and plugin loader announcing themselves. The load-time announcements are removed; the per-call ones (registry register, plugin widget loads, "Render called") now go through the page's debugLog switch (localStorage.pluginDebug), guarded because the widgets also load in node tests without it. fonts.html and wifi.html debug logging goes through debugLog as well. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(api): drop the removed music-auth and of-the-day JSON routes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Chuck
@@ -1,94 +1,10 @@
|
||||
"""
|
||||
Input validation utilities for the web interface.
|
||||
Provides validation functions for user inputs to prevent XSS, invalid data, and security issues.
|
||||
"""
|
||||
import re
|
||||
from typing import Optional, Tuple, List
|
||||
from urllib.parse import urlparse
|
||||
from pathlib import Path
|
||||
|
||||
|
||||
def escape_html(text: str) -> str:
|
||||
"""Escape HTML entities in text to prevent XSS."""
|
||||
if not isinstance(text, str):
|
||||
text = str(text)
|
||||
# Use basic HTML entity escaping
|
||||
text = text.replace('&', '&')
|
||||
text = text.replace('<', '<')
|
||||
text = text.replace('>', '>')
|
||||
text = text.replace('"', '"')
|
||||
text = text.replace("'", ''')
|
||||
return text
|
||||
|
||||
|
||||
def validate_image_url(url: str) -> Tuple[bool, Optional[str]]:
|
||||
"""
|
||||
Validate and sanitize image URLs to prevent XSS and protocol injection.
|
||||
|
||||
Returns:
|
||||
Tuple of (is_valid, error_message)
|
||||
"""
|
||||
if not url or not isinstance(url, str):
|
||||
return False, "URL must be a non-empty string"
|
||||
|
||||
url_lower = url.lower().strip()
|
||||
|
||||
# Reject dangerous protocols
|
||||
dangerous_protocols = ['javascript:', 'data:', 'vbscript:', 'file:']
|
||||
for protocol in dangerous_protocols:
|
||||
if url_lower.startswith(protocol):
|
||||
return False, f"Dangerous protocol '{protocol}' not allowed"
|
||||
|
||||
# Reject event handlers
|
||||
if any(handler in url_lower for handler in ['onerror=', 'onload=', 'onclick=']):
|
||||
return False, "Event handlers not allowed in URLs"
|
||||
|
||||
# Reject directory traversal anywhere, not only in relative paths:
|
||||
# http://host/../secret is as much a traversal attempt as /../secret.
|
||||
if '..' in url:
|
||||
return False, "Invalid path: directory traversal not allowed"
|
||||
|
||||
# Allow relative paths starting with /
|
||||
if url.startswith('/'):
|
||||
# // would be a protocol-relative URL, not a local path
|
||||
if url.startswith('//'):
|
||||
return False, "Invalid relative path"
|
||||
return True, None
|
||||
|
||||
# Validate absolute URLs
|
||||
try:
|
||||
parsed = urlparse(url)
|
||||
allowed_protocols = ['http', 'https']
|
||||
if parsed.scheme not in allowed_protocols:
|
||||
return False, "Only http:// and https:// protocols are allowed"
|
||||
return True, None
|
||||
except Exception as e:
|
||||
return False, f"Invalid URL format: {str(e)}"
|
||||
|
||||
|
||||
def validate_font_awesome_class(class_name: str) -> Tuple[bool, Optional[str]]:
|
||||
"""
|
||||
Validate Font Awesome class names to prevent XSS.
|
||||
|
||||
Returns:
|
||||
Tuple of (is_valid, error_message)
|
||||
"""
|
||||
if not isinstance(class_name, str):
|
||||
return False, "Class name must be a string"
|
||||
|
||||
# Whitelist pattern: only allow alphanumeric, dash, underscore, and spaces
|
||||
# Must contain 'fa-' for Font Awesome
|
||||
fa_pattern = re.compile(r'^[a-zA-Z0-9\s_-]*fa-[a-zA-Z0-9-]+[a-zA-Z0-9\s_-]*$')
|
||||
|
||||
if not fa_pattern.match(class_name):
|
||||
return False, "Invalid Font Awesome class name format"
|
||||
|
||||
if 'fa-' not in class_name:
|
||||
return False, "Font Awesome class must contain 'fa-'"
|
||||
|
||||
return True, None
|
||||
|
||||
|
||||
def validate_file_upload(filename: str, max_size_mb: int = 10,
|
||||
allowed_extensions: Optional[List[str]] = None) -> Tuple[bool, Optional[str]]:
|
||||
"""
|
||||
@@ -119,117 +35,6 @@ def validate_file_upload(filename: str, max_size_mb: int = 10,
|
||||
return True, None
|
||||
|
||||
|
||||
def validate_mime_type(file_path: str, allowed_types: List[str]) -> Tuple[bool, Optional[str]]:
|
||||
"""
|
||||
Validate file MIME type.
|
||||
|
||||
Args:
|
||||
file_path: Path to the file
|
||||
allowed_types: List of allowed MIME types (e.g., ['image/png', 'image/jpeg'])
|
||||
|
||||
Returns:
|
||||
Tuple of (is_valid, error_message)
|
||||
"""
|
||||
try:
|
||||
import mimetypes
|
||||
mime_type, _ = mimetypes.guess_type(file_path)
|
||||
|
||||
if not mime_type:
|
||||
return False, "Could not determine file type"
|
||||
|
||||
if mime_type not in allowed_types:
|
||||
return False, f"File type '{mime_type}' not allowed. Allowed types: {', '.join(allowed_types)}"
|
||||
|
||||
return True, None
|
||||
except Exception as e:
|
||||
return False, f"Error validating MIME type: {str(e)}"
|
||||
|
||||
|
||||
def validate_numeric_range(value: float, min_val: Optional[float] = None,
|
||||
max_val: Optional[float] = None) -> Tuple[bool, Optional[str]]:
|
||||
"""
|
||||
Validate numeric value is within range.
|
||||
|
||||
Returns:
|
||||
Tuple of (is_valid, error_message)
|
||||
"""
|
||||
# bool is an int subclass, so True would otherwise validate as 1.
|
||||
if not isinstance(value, (int, float)) or isinstance(value, bool):
|
||||
return False, "Value must be a number"
|
||||
|
||||
if min_val is not None and value < min_val:
|
||||
return False, f"Value must be at least {min_val}"
|
||||
|
||||
if max_val is not None and value > max_val:
|
||||
return False, f"Value must be at most {max_val}"
|
||||
|
||||
return True, None
|
||||
|
||||
|
||||
def validate_string_length(text: str, min_length: Optional[int] = None,
|
||||
max_length: Optional[int] = None) -> Tuple[bool, Optional[str]]:
|
||||
"""
|
||||
Validate string length.
|
||||
|
||||
Returns:
|
||||
Tuple of (is_valid, error_message)
|
||||
"""
|
||||
if not isinstance(text, str):
|
||||
return False, "Value must be a string"
|
||||
|
||||
length = len(text)
|
||||
|
||||
if min_length is not None and length < min_length:
|
||||
return False, f"String must be at least {min_length} characters"
|
||||
|
||||
if max_length is not None and length > max_length:
|
||||
return False, f"String must be at most {max_length} characters"
|
||||
|
||||
return True, None
|
||||
|
||||
|
||||
def sanitize_plugin_config(config: dict) -> dict:
|
||||
"""
|
||||
Restrict a plugin config to safe key names and value types.
|
||||
|
||||
Drops keys that are not plain identifiers and values that are not
|
||||
JSON-ish scalars, lists, or dicts, recursing into the latter two.
|
||||
|
||||
String values are returned **unescaped**: output escaping is the
|
||||
template layer's job, and escaping here would store the escaped form
|
||||
in config.json. Do not read this function as XSS protection for
|
||||
rendered output.
|
||||
|
||||
Args:
|
||||
config: Configuration dictionary
|
||||
|
||||
Returns:
|
||||
Sanitized configuration dictionary
|
||||
"""
|
||||
sanitized = {}
|
||||
|
||||
for key, value in config.items():
|
||||
# Sanitize keys (no special characters)
|
||||
if not isinstance(key, str) or not re.match(r'^[a-zA-Z0-9_]+$', key):
|
||||
continue # Skip invalid keys
|
||||
|
||||
# Sanitize values based on type
|
||||
if isinstance(value, str):
|
||||
# For string values, escape HTML but preserve the string
|
||||
sanitized[key] = value # Don't escape - let templates handle it
|
||||
elif isinstance(value, (int, float, bool)):
|
||||
sanitized[key] = value
|
||||
elif isinstance(value, list):
|
||||
sanitized[key] = [sanitize_plugin_config(item) if isinstance(item, dict) else item for item in value]
|
||||
elif isinstance(value, dict):
|
||||
sanitized[key] = sanitize_plugin_config(value)
|
||||
else:
|
||||
# Skip unknown types
|
||||
continue
|
||||
|
||||
return sanitized
|
||||
|
||||
|
||||
def dedup_unique_arrays(cfg: dict, schema_node: dict) -> None:
|
||||
"""Recursively deduplicate arrays with uniqueItems constraint.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user