codebread 1.0.1__tar.gz → 1.0.2__tar.gz

{codebread-1.0.1 → codebread-1.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codebread
-Version: 1.0.1
+Version: 1.0.2
 Summary: Interactive codebase analyzer & visualizer — slice open a project and see how it's wired together.
 Author: Danial Irsyad
 License: MIT
@@ -22,7 +22,7 @@ Dynamic: license-file
 </p>
 
 <p align="center">
-  <img alt="version" src="https://img.shields.io/badge/version-1.0.1-2dd4bf">
+  <img alt="version" src="https://img.shields.io/badge/version-1.0.2-2dd4bf">
   <img alt="python" src="https://img.shields.io/badge/python-3.9%2B-0284c7">
   <img alt="deps" src="https://img.shields.io/badge/required%20dependencies-none-2dd4bf">
   <img alt="license" src="https://img.shields.io/badge/license-MIT-8b5cf6">

{codebread-1.0.1 → codebread-1.0.2}/README.md

@@ -8,7 +8,7 @@
 </p>
 
 <p align="center">
-  <img alt="version" src="https://img.shields.io/badge/version-1.0.1-2dd4bf">
+  <img alt="version" src="https://img.shields.io/badge/version-1.0.2-2dd4bf">
   <img alt="python" src="https://img.shields.io/badge/python-3.9%2B-0284c7">
   <img alt="deps" src="https://img.shields.io/badge/required%20dependencies-none-2dd4bf">
   <img alt="license" src="https://img.shields.io/badge/license-MIT-8b5cf6">

{codebread-1.0.1 → codebread-1.0.2}/codebread/__init__.py

@@ -1,3 +1,3 @@
 """CodeBread — slice open a codebase and see its internal structure."""
 
-__version__ = "1.0.1"
+__version__ = "1.0.2"

{codebread-1.0.1 → codebread-1.0.2}/codebread/analyzer.py

@@ -34,8 +34,12 @@ def analyze(root: str,
             info.warnings.append(err)
         info.layer = classify(info, text)
         if info.parsed or info.language in ("html", "css"):
-            info.source = text if len(text) <= 300_000 else \
+            src = text if len(text) <= 300_000 else \
                 text[:300_000] + "\n… (truncated)"
+            if info.language == "config":
+                from .parsers.generic_parser import redact_secrets
+                src = redact_secrets(src)
+            info.source = src
         parsed.append(info)
         for w in info.warnings:
             if w.startswith("Unsupported:"):

{codebread-1.0.1 → codebread-1.0.2}/codebread/parsers/generic_parser.py

@@ -286,3 +286,17 @@ def parse_config(info: FileInfo, text: str) -> None:
                 value = value[:57] + "..."
         info.db_config.append(f"{key} = {value}")
     info.db_config = info.db_config[:20]
+
+
+def redact_secrets(text: str) -> str:
+    """Mask secret-looking values line by line. Used on config-file source
+    before it's stored/exported, so the raw "IDE view" / JSON export can't
+    leak what the DB-config summary already redacts."""
+    out = []
+    for line in text.splitlines():
+        m = re.match(r"^(\s*[\"']?[\w.\-]+[\"']?\s*[:=]\s*)(.+)$", line)
+        if m and SECRET_KEY_RE.search(m.group(1)):
+            out.append(m.group(1) + "•••masked•••")
+        else:
+            out.append(URL_CREDS_RE.sub("://***:***@", line))
+    return "\n".join(out)

{codebread-1.0.1 → codebread-1.0.2}/codebread/server.py

@@ -10,6 +10,7 @@ from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from typing import Dict
 
 WEB_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), "web")
+WEB_ROOT = os.path.realpath(WEB_DIR)
 
 MIME = {".html": "text/html; charset=utf-8",
         ".js": "application/javascript; charset=utf-8",
@@ -45,11 +46,19 @@ def serve(graph: Dict, port: int = 8137, open_browser: bool = True) -> None:
                 self._file(path.lstrip("/"))
 
         def _file(self, rel: str):
-            rel = os.path.normpath(rel).replace("\\", "/")
-            if rel.startswith("..") or rel.startswith("/"):
+            # Resolve against WEB_DIR and verify the *result* is still inside
+            # it. String-prefix checks on `rel` alone aren't enough: on
+            # Windows, os.path.join(WEB_DIR, "C:/some/file") silently
+            # discards WEB_DIR because the second argument is drive-absolute,
+            # which would otherwise let a request read any file on disk.
+            full = os.path.realpath(os.path.join(WEB_DIR, rel))
+            try:
+                inside = os.path.commonpath([full, WEB_ROOT]) == WEB_ROOT
+            except ValueError:
+                inside = False  # e.g. different drives on Windows
+            if not inside:
                 self.send_error(403)
                 return
-            full = os.path.join(WEB_DIR, rel)
             if not os.path.isfile(full):
                 self.send_error(404)
                 return

{codebread-1.0.1 → codebread-1.0.2}/codebread.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codebread
-Version: 1.0.1
+Version: 1.0.2
 Summary: Interactive codebase analyzer & visualizer — slice open a project and see how it's wired together.
 Author: Danial Irsyad
 License: MIT
@@ -22,7 +22,7 @@ Dynamic: license-file
 </p>
 
 <p align="center">
-  <img alt="version" src="https://img.shields.io/badge/version-1.0.1-2dd4bf">
+  <img alt="version" src="https://img.shields.io/badge/version-1.0.2-2dd4bf">
   <img alt="python" src="https://img.shields.io/badge/python-3.9%2B-0284c7">
   <img alt="deps" src="https://img.shields.io/badge/required%20dependencies-none-2dd4bf">
   <img alt="license" src="https://img.shields.io/badge/license-MIT-8b5cf6">

{codebread-1.0.1 → codebread-1.0.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "codebread"
-version = "1.0.1"
+version = "1.0.2"
 description = "Interactive codebase analyzer & visualizer — slice open a project and see how it's wired together."
 readme = "README.md"
 requires-python = ">=3.9"