a2nr
/
elemes
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
elemes/requirements.txt

8 lines
146 B
Plaintext
Raw Normal View History

init
2026-01-02 06:18:48 +07:00
Flask==2.3.3
markdown==3.5
update example
2026-01-06 21:38:54 +07:00
gunicorn==21.2.0
refactor to make it better
2026-03-25 09:39:51 +07:00
flask-cors==4.0.0
security: implement gVisor sandboxing and harden API endpoints - Menambahkan service 'compiler-worker' terpisah untuk isolasi eksekusi kode C/Python. - Mengintegrasikan gVisor (runsc) pada worker untuk mencegah RCE pada level kernel. - Menggunakan Gunicorn (4 workers) pada compiler-worker untuk mendukung concurrency. - Menambahkan otentikasi token wajib pada endpoint /compile dan laporan progres. - Memperketat CORS policy menggunakan environment variable ORIGIN. - Menerapkan secure_filename pada rute pelajaran untuk mencegah Path Traversal. - Mengubah volume mounting backend utama menjadi Read-Only (:ro) untuk perlindungan data. - Memperbarui proposal.md dan .env.example dengan standar keamanan terbaru.
2026-04-21 15:13:16 +07:00
python-dotenv==1.0.0
feat(security): implement anonymous access with rate limiting and secure proxy, harden authentication and implement session protection Implements multiple layers of security to address high-risk session and authentication vulnerabilities identified in the security review: - Allow code compilation (C, Python, Arduino) for anonymous users. - Enforce a 1-request-per-2-minutes rate limit for anonymous IPs. - Implement a global anonymous compilation queue with 20 concurrent slots. - Proxy Velxio (Arduino) compilation through Flask to prevent API hijacking. - Exempt authenticated users (tokens/cookies) from all rate limits. - Fix networking and DNS resolution in podman-compose. - Fix Svelte a11y warnings and trailing slash routing issues. - Cookie Security: Added dynamic 'secure' flag support via COOKIE_SECURE env variable for HTTPS/Tailscale Funnel compatibility. - Rate Limiting: Integrated Flask-Limiter on /login (50 req/min) to prevent API abuse while accommodating shared school networks (NAT). - Tarpitting: Added 1.5s artificial delay on failed logins to neutralize automated brute-force tools without blocking legitimate users. - Session Invalidation: Implemented an in-memory token blacklist on logout to ensure session tokens cannot be reused. - Documentation: Updated technical docs and proposal status to reflect the current security architecture. Ref: @elemes/proposal.md (Poin 6.1, 6.2, 6.3)
2026-04-22 12:57:54 +07:00
requests==2.31.0
feat: implement LaTeX support with KaTeX and python-markdown-math 3 - Integration of KaTeX in frontend (SvelteKit) with a custom renderMath` action. - Added `python-markdown-math` extension in backend (Flask). to handle math blocks. - Configured Vite to handle KaTeX during SSR and browser rendering. - Added a LaTeX test lesson and updated home navigation. - Supported both inline ($) and block ($$) math rendering, including multi-line support.
2026-04-26 15:47:11 +07:00
flask-limiter==3.5.0
python-markdown-math==0.8