a2nr
/
elemes
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
elemes/routes
History
a2nr bb8ca50650 fix(upload): review — CSP SVG, boundary 5 MiB, regression guard 502/413 
Hasil review pasca-fix upload asset:

Keamanan:
- Mitigasi stored-XSS via SVG (route /assets/* publik, same-origin):
  CSP 'default-src none; sandbox' saat serve SVG — di backend
  (send_assets) DAN di proxy SvelteKit (proxy hanya meneruskan
  content-type/set-cookie, jadi CSP backend tak sampai ke browser).
- Deteksi 413 proxy kini ber-test status code + pesan.

Testing:
- Regression guard: error jaringan biasa tetap 502, bukan 413.
- 413 via status code saja (tanpa regex pesan) tetap 413.
- Boundary 5 MiB: file TEPAT 5 MiB lolos; 5 MiB+1 ditolak (cabang
  len(raw) — SVG dipakai karena dikecualikan validasi PIL).
- CSP: SVG dapat header, raster tidak.
- E2E script (verify_asset_upload.py) memakai file asli
  mr-edu/assets/ilustrasi_beban.jpeg + test 413 terintegrasi.

Reuseability:
- Komentar silang-referensi _MAX_ASSET_BYTES (sumber) dengan pesan 413
  proxy dan BODY_SIZE_LIMIT compose.
 		2026-10-03 08:06:29 +07:00
..
__init__.py refactor to make it better 2026-03-25 09:39:51 +07:00
auth.py perf: fix race conditions with file locking and optimize backend latency 2026-05-05 22:57:19 +07:00
compile.py feat(compiler-worker): sesi interaktif PTY untuk playground — Python input() dan C scanf() tanpa EOFError 2026-08-02 14:14:45 +00:00
content_editor.py fix(upload): review — CSP SVG, boundary 5 MiB, regression guard 502/413 2026-10-03 08:06:29 +07:00
docs.py feat: unified lesson progress — composite score & /api/lesson-progress 2026-08-29 00:22:10 +07:00
help.py feat(help): add interactive student tutorial with video and integrated help page 2026-04-20 13:43:45 +07:00
lesson_progress.py fix(quiz): enforce 75% passing threshold, sync server progress, and persist attempt review 2026-09-09 07:33:52 +07:00
lessons.py fix(upload): review — CSP SVG, boundary 5 MiB, regression guard 502/413 2026-10-03 08:06:29 +07:00
progress.py feat(teacher): refactor progress into tree view and separate classroom management 2026-09-15 04:51:35 +07:00
student_management.py feat(progress): composite scoring, roundtrip CSV grammar, and report export 2026-08-30 04:12:23 +07:00