codebread 1.0.1__py3-none-any.whl → 1.0.2__py3-none-any.whl

codebread/__init__.py

@@ -1,3 +1,3 @@
 """CodeBread — slice open a codebase and see its internal structure."""
 
-__version__ = "1.0.1"
+__version__ = "1.0.2"

codebread/analyzer.py

@@ -34,8 +34,12 @@ def analyze(root: str,
             info.warnings.append(err)
         info.layer = classify(info, text)
         if info.parsed or info.language in ("html", "css"):
-            info.source = text if len(text) <= 300_000 else \
+            src = text if len(text) <= 300_000 else \
                 text[:300_000] + "\n… (truncated)"
+            if info.language == "config":
+                from .parsers.generic_parser import redact_secrets
+                src = redact_secrets(src)
+            info.source = src
         parsed.append(info)
         for w in info.warnings:
             if w.startswith("Unsupported:"):

codebread/parsers/generic_parser.py

@@ -286,3 +286,17 @@ def parse_config(info: FileInfo, text: str) -> None:
                 value = value[:57] + "..."
         info.db_config.append(f"{key} = {value}")
     info.db_config = info.db_config[:20]
+
+
+def redact_secrets(text: str) -> str:
+    """Mask secret-looking values line by line. Used on config-file source
+    before it's stored/exported, so the raw "IDE view" / JSON export can't
+    leak what the DB-config summary already redacts."""
+    out = []
+    for line in text.splitlines():
+        m = re.match(r"^(\s*[\"']?[\w.\-]+[\"']?\s*[:=]\s*)(.+)$", line)
+        if m and SECRET_KEY_RE.search(m.group(1)):
+            out.append(m.group(1) + "•••masked•••")
+        else:
+            out.append(URL_CREDS_RE.sub("://***:***@", line))
+    return "\n".join(out)

codebread/server.py

@@ -10,6 +10,7 @@ from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from typing import Dict
 
 WEB_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), "web")
+WEB_ROOT = os.path.realpath(WEB_DIR)
 
 MIME = {".html": "text/html; charset=utf-8",
         ".js": "application/javascript; charset=utf-8",
@@ -45,11 +46,19 @@ def serve(graph: Dict, port: int = 8137, open_browser: bool = True) -> None:
                 self._file(path.lstrip("/"))
 
         def _file(self, rel: str):
-            rel = os.path.normpath(rel).replace("\\", "/")
-            if rel.startswith("..") or rel.startswith("/"):
+            # Resolve against WEB_DIR and verify the *result* is still inside
+            # it. String-prefix checks on `rel` alone aren't enough: on
+            # Windows, os.path.join(WEB_DIR, "C:/some/file") silently
+            # discards WEB_DIR because the second argument is drive-absolute,
+            # which would otherwise let a request read any file on disk.
+            full = os.path.realpath(os.path.join(WEB_DIR, rel))
+            try:
+                inside = os.path.commonpath([full, WEB_ROOT]) == WEB_ROOT
+            except ValueError:
+                inside = False  # e.g. different drives on Windows
+            if not inside:
                 self.send_error(403)
                 return
-            full = os.path.join(WEB_DIR, rel)
             if not os.path.isfile(full):
                 self.send_error(404)
                 return

{codebread-1.0.1.dist-info → codebread-1.0.2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codebread
-Version: 1.0.1
+Version: 1.0.2
 Summary: Interactive codebase analyzer & visualizer — slice open a project and see how it's wired together.
 Author: Danial Irsyad
 License: MIT
@@ -22,7 +22,7 @@ Dynamic: license-file
 </p>
 
 <p align="center">
-  <img alt="version" src="https://img.shields.io/badge/version-1.0.1-2dd4bf">
+  <img alt="version" src="https://img.shields.io/badge/version-1.0.2-2dd4bf">
   <img alt="python" src="https://img.shields.io/badge/python-3.9%2B-0284c7">
   <img alt="deps" src="https://img.shields.io/badge/required%20dependencies-none-2dd4bf">
   <img alt="license" src="https://img.shields.io/badge/license-MIT-8b5cf6">

{codebread-1.0.1.dist-info → codebread-1.0.2.dist-info}/RECORD

@@ -1,5 +1,5 @@
-codebread/__init__.py,sha256=zaQz04FV7Jd-aoPIR3qYYkZq1BbI0XO3OWKdY1hjya0,97
-codebread/analyzer.py,sha256=7uf00Lw5jjtsA4-fb8x2bUsoZybyPNeVQsXSBx1bPhY,3061
+codebread/__init__.py,sha256=InwUkpEmPv-mS3-33Vu1RXBTw1Zm4tYbe9RB4DAsW5s,97
+codebread/analyzer.py,sha256=tCsV0Cwi1l-If5zbNLbMtsuKW3o-rl8mekNG-B7MXpY,3234
 codebread/classifier.py,sha256=jehD-XQ80CP_O4x9YRi4JQqzd4AaHxKpzI83wLG1yvM,4067
 codebread/cli.py,sha256=AMvwk29cOJDjsI-I07pCGbqogdtq1Y6HWnT52FHYyLs,4072
 codebread/connections.py,sha256=FN0c-W9_tnQUVetnF0eVyC6lllyBOyZ3512sXShpy7Q,16609
@@ -8,17 +8,17 @@ codebread/export.py,sha256=rKYmzuSEXYDrgcItnhdyXI_lo0LN2PSoMe0hYElzU88,1512
 codebread/languages.py,sha256=SKHy9v7QPreWZG6FbuX3B0-kq1jqVn-rmwNqJ9ESFqo,4494
 codebread/models.py,sha256=Sw2PJW63dKyl5RpWwfY2ZvCJLYttmjoQg4O5H5DtLgM,4214
 codebread/scanner.py,sha256=bEXSaoENmJ-C_oabj2IF1aWs9-LaIqMc80xXQvo7-eg,8020
-codebread/server.py,sha256=9MPHNx3b_KQV4YA4XGeW9vhfkiq4jz-j5f6M9RDyhSc,3020
+codebread/server.py,sha256=H3kUXJaH8FkExNUwdwSD2HxBMceC_24o6pVSjJjFh8g,3543
 codebread/parsers/__init__.py,sha256=ovsvmXGClshiUlDdx6mkBmRu8__OZIqYos6-1eLb9eM,2285
-codebread/parsers/generic_parser.py,sha256=5XveP1AkCpIni9faEU9MRc93ZGHek7_R_TkQSZEOxts,11382
+codebread/parsers/generic_parser.py,sha256=lz-wLsmQYERoDRM27lhEP3cvNYbomHfA--VI_3LmJ5E,11966
 codebread/parsers/javascript_parser.py,sha256=lVIlydQ3--Owd78816XIM77NntfQ97DeLzYvPrjd5GE,15916
 codebread/parsers/python_parser.py,sha256=QnhCLx01bKYLYqav33cI27qbEQNPUiXnS5uN7cb8poQ,11671
 codebread/web/app.js,sha256=P1zpCHNMyczAuLWL9zM5htl9E3wG3jJdpZ6orLhixTM,65672
 codebread/web/index.html,sha256=6YqjC_wO3pfqyG_11uIhvRM16Wagu2l8eSOs1FNc-UY,8693
 codebread/web/style.css,sha256=fiq1bC-I1bC6-6MxRn0blQwGOjO_fdClPrhf5W7zqPw,23729
-codebread-1.0.1.dist-info/licenses/LICENSE,sha256=okINupIvMgiuOlvMVpsM9DT5jb6QQmKBd--yfZq4bjc,1070
-codebread-1.0.1.dist-info/METADATA,sha256=jsimg1QlF58mJVpAOs4L2Oh12i7R_kE0GSDGgBhHCHM,11367
-codebread-1.0.1.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
-codebread-1.0.1.dist-info/entry_points.txt,sha256=ItG61aUP1YTvA_zA-jlUshBc5BPpJDpCyVnsyaxNXKA,49
-codebread-1.0.1.dist-info/top_level.txt,sha256=KctFB7UQb4tN9YotaJD95GuHWIQuoO5VqyLdo_gEswQ,10
-codebread-1.0.1.dist-info/RECORD,,
+codebread-1.0.2.dist-info/licenses/LICENSE,sha256=okINupIvMgiuOlvMVpsM9DT5jb6QQmKBd--yfZq4bjc,1070
+codebread-1.0.2.dist-info/METADATA,sha256=zWaglNGGhQUvXpPnyXwNdS_a6Og2jdIFhWImFNlGvAY,11367
+codebread-1.0.2.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
+codebread-1.0.2.dist-info/entry_points.txt,sha256=ItG61aUP1YTvA_zA-jlUshBc5BPpJDpCyVnsyaxNXKA,49
+codebread-1.0.2.dist-info/top_level.txt,sha256=KctFB7UQb4tN9YotaJD95GuHWIQuoO5VqyLdo_gEswQ,10
+codebread-1.0.2.dist-info/RECORD,,