a2nr
/
elemes
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
elemes/services
History
a2nr bb8ca50650 fix(upload): review — CSP SVG, boundary 5 MiB, regression guard 502/413 
Hasil review pasca-fix upload asset:

Keamanan:
- Mitigasi stored-XSS via SVG (route /assets/* publik, same-origin):
  CSP 'default-src none; sandbox' saat serve SVG — di backend
  (send_assets) DAN di proxy SvelteKit (proxy hanya meneruskan
  content-type/set-cookie, jadi CSP backend tak sampai ke browser).
- Deteksi 413 proxy kini ber-test status code + pesan.

Testing:
- Regression guard: error jaringan biasa tetap 502, bukan 413.
- 413 via status code saja (tanpa regex pesan) tetap 413.
- Boundary 5 MiB: file TEPAT 5 MiB lolos; 5 MiB+1 ditolak (cabang
  len(raw) — SVG dipakai karena dikecualikan validasi PIL).
- CSP: SVG dapat header, raster tidak.
- E2E script (verify_asset_upload.py) memakai file asli
  mr-edu/assets/ilustrasi_beban.jpeg + test 413 terintegrasi.

Reuseability:
- Komentar silang-referensi _MAX_ASSET_BYTES (sumber) dengan pesan 413
  proxy dan BODY_SIZE_LIMIT compose.
 		2026-10-03 08:06:29 +07:00
..
scripts fix(markdown): sanitasi DOMPurify, perbaikan parser flashcard & kompatibilitas SSR Node 20 2026-08-28 05:24:44 +07:00
storage fix(quiz): enforce 75% passing threshold, sync server progress, and persist attempt review 2026-09-09 07:33:52 +07:00
tests fix(upload): review — CSP SVG, boundary 5 MiB, regression guard 502/413 2026-10-03 08:06:29 +07:00
__init__.py
…
database.py
…
docs_service.py fix(docs/api): hilangkan sync berulang di api_reference + UI API Reference di /docs 2026-08-17 16:37:30 +07:00
evaluation.py feat: unified lesson progress — composite score & /api/lesson-progress 2026-08-29 00:22:10 +07:00
lesson_registry.py fix(review): address code review findings for dev to master merge 2026-09-06 18:08:58 +07:00
lesson_service.py feat(student-management): sync imported progress with composite model and add inline expected format to CSV headers 2026-09-08 19:01:33 +07:00
models.py feat: unified lesson progress — composite score & /api/lesson-progress 2026-08-29 00:22:10 +07:00
progress_status.py feat(progress): composite scoring, roundtrip CSV grammar, and report export 2026-08-30 04:12:23 +07:00
repositories.py feat(student-management): sync imported progress with composite model and add inline expected format to CSV headers 2026-09-08 19:01:33 +07:00
student_roundtrip.py feat(student-management): sync imported progress with composite model and add inline expected format to CSV headers 2026-09-08 19:01:33 +07:00
teacher_auth.py feat(content-editor): konfirmasi ganda file navigasi kritis & hapus narrow sidebar 2026-08-23 08:18:02 +07:00
teacher_bootstrap.py
…
token_hashing.py
…
token_service.py fix(quiz): enforce 75% passing threshold, sync server progress, and persist attempt review 2026-09-09 07:33:52 +07:00