Donkie 72daa29cd2 security: finish the audit's low-severity items ...

Task 10: config.js JSON-encodes the base path, so a backslash cannot
escape the string literal the way the old " check allowed; search.py
escapes LIKE wildcards at both its call sites, using a helper moved into
database/utils.py so it and extra_field_query share one implementation.

Task 9 was a pair of decisions rather than fixes. /info keeps its paths:
both clients render them and removing response fields breaks API v1, while
the disclosure buys nothing against an API that is unauthenticated anyway.
/metrics keeps its shape but now says what it publishes when switched on.

Also pins the unit tests to a throwaway data directory -- importing
spoolman.main creates one as a side effect, and it was the real one.

2026-07-31 09:42:32 +02:00

..

__init__.py

security: add shared origin-trust helper

2026-07-27 08:51:11 +02:00

conftest.py

security: finish the audit's low-severity items

2026-07-31 09:42:32 +02:00

test_backup_rotation.py

security: stop backup rotation from churning away the restore history

2026-07-27 19:33:07 +02:00

test_configjs.py

security: finish the audit's low-severity items

2026-07-31 09:42:32 +02:00

test_env.py

security: add shared origin-trust helper

2026-07-27 08:51:11 +02:00

test_export.py

security: escape CSV formulas and bound extra-field sizes

2026-07-27 19:58:52 +02:00

test_extra_field_registry.py

security: escape CSV formulas and bound extra-field sizes

2026-07-27 19:58:52 +02:00

test_host_validation.py

security: make the host guard opt-in

2026-07-31 09:36:41 +02:00

test_like_escaping.py

security: finish the audit's low-severity items

2026-07-31 09:42:32 +02:00

test_security.py

security: drop CORS credentials under a wildcard origin, document the model

2026-07-27 19:36:47 +02:00

test_sort_parsing.py

fix: return 400 instead of 500 for malformed sort parameters

2026-07-27 20:03:14 +02:00