Donkie
7d683eb246
Two lower-severity findings from the audit (todo.md tasks 6 and 7). A spreadsheet executes a cell that begins with =, +, -, @, tab or CR, so a vendor named `=cmd|' /C calc'!A0` runs when someone opens the CSV export (CWE-1236). Such cells are now prefixed with a single quote, which spreadsheets read as "this is literal text" and do not display. Only strings are escaped -- numbers reach the writer as numeric types, so a negative number cannot be mistaken for a formula and must not grow a stray quote. Header names need no escaping: they are fixed attribute names or extra-field keys, which are already constrained to ^[a-z0-9_]+$. Exports also gained Content-Disposition, so they download under a sensible name rather than rendering in the browser. Extra-field values had no size limit and the columns are Text(), so a single request could store megabytes: unbounded database growth, and the resulting websocket event overflowed the 1 MiB default frame limit, which killed live updates for every connected client. Values are now capped at the same 65535 characters as settings. The number of extra fields per entity is capped too -- the per-entity key count was already bounded, since unknown keys are rejected, but the registry itself could be grown without limit, and it is cached in memory and embedded in every entity response. Finally, a setting larger than the column limit returned 500; the ValueError is now caught and returned as a 400. Verified end-to-end: a 2 MB extra value is refused on both create and update, an oversized setting returns 400 and leaves the setting unset, normal values still work, and a vendor named `=cmd|' /C calc'!A0` exports as `'=cmd|' /C calc'!A0` while the JSON export keeps the raw name.
Keep track of your inventory of 3D-printer filament spools.
Spoolman is a self-hosted web service designed to help you efficiently manage your 3D printer filament spools and monitor their usage. It acts as a centralized database that seamlessly integrates with popular 3D printing software like OctoPrint and Klipper/Moonraker. When connected, it automatically updates spool weights as printing progresses, giving you real-time insights into filament usage.
Features
- Filament Management: Keep comprehensive records of filament types, manufacturers, and individual spools.
- API Integration: The REST API allows easy integration with other software, facilitating automated workflows and data exchange.
- Real-Time Updates: Stay informed with live spool updates through Websockets, providing immediate feedback during printing operations.
- Central Filament Database: A community-supported database of manufacturers and filaments simplify adding new spools to your inventory. Contribute by heading to SpoolmanDB.
- Web-Based Client: Spoolman includes a built-in web client that lets you manage data effortlessly:
- View, create, edit, and delete filament data.
- Add custom fields to tailor information to your specific needs.
- Print labels with QR codes for easy spool identification and tracking.
- Contribute to its translation into 18 languages via Weblate.
- Database Support: SQLite, PostgreSQL, MySQL, and CockroachDB.
- Multi-Printer Management: Handles spool updates from several printers simultaneously.
- Advanced Monitoring: Integrate with Prometheus for detailed historical analysis of filament usage, helping you track and optimize your printing processes. See the Wiki for instructions on how to set it up.
Spoolman integrates with:
- Moonraker and most front-ends (Fluidd, KlipperScreen, Mainsail, ...)
- OctoPrint
- OctoEverywhere
- Home Assistant
- MCP Server - Manage your filament inventory through AI assistants like Claude using the Model Context Protocol
Web client preview:
Security
Spoolman has no authentication. This is by design — it is built to sit on a trusted home network alongside your printers, where requiring a login for every Moonraker or OctoPrint call would only get in the way. It does mean that anyone who can reach Spoolman over the network can read and modify your entire inventory.
If your instance is reachable from beyond your own LAN, put it behind a reverse proxy that handles authentication (Authelia, Authentik, or your proxy's own basic auth). Do not forward a port to it directly.
Spoolman does defend the one boundary a browser can be tricked into crossing on your behalf: a website you visit cannot make your browser write to your Spoolman instance, or open a websocket to it, unless it is an origin you have allowed. That protection is not a substitute for the above — it does nothing about anyone already on your network.
SPOOLMAN_CORS_ORIGIN
A comma-separated list of extra browser origins allowed to talk to Spoolman, for example
https://fluidd.local,https://mainsail.local. Leave it unset unless you have a browser-based
client on a different origin; the built-in web client does not need it, and neither does
Moonraker, OctoPrint, Home Assistant or anything else that is not a browser.
Warning
Setting it to
*turns the origin checks off entirely, which means any website you happen to visit can read and modify your Spoolman data in the background. Only do this on a network you trust completely, and list the origins you actually need instead wherever you can. Debug mode (SPOOLMAN_DEBUG_MODE) has the same effect and is not meant for normal use.
If you run Spoolman behind a reverse proxy, forward the original host — nginx
proxy_set_header Host $host;, Apache ProxyPreserveHost On, or the X-Forwarded-Host header,
any of which is enough. Traefik, Caddy and HAProxy do this by default.
Installation
Please see the Installation page on the Wiki for details how to install Spoolman.