cvfile-haystack 0.2.0__tar.gz → 0.3.2__tar.gz

{cvfile_haystack-0.2.0 → cvfile_haystack-0.3.2}/.gitignore

@@ -65,3 +65,16 @@ src-tauri/target/
 *.seed
 *.tgz
 .vercel
+
+# Launch material (HN/PH drafts, runbook, screenshots) and private outreach
+# data (PII): kept local, purged from history, never published.
+launch/
+
+# Internal planning documents: business strategy, launch gates, monetization.
+# Kept local, never published.
+PLAN.md
+ROADMAP.md
+
+# Generated demo/build artefacts that escape the dist/ pattern
+dist-demo/
+docs/public/embed/

{cvfile_haystack-0.2.0 → cvfile_haystack-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cvfile-haystack
-Version: 0.2.0
+Version: 0.3.2
 Summary: Haystack integration for the .cv open file format.
 Project-URL: Homepage, https://cvfile.org
 Project-URL: Repository, https://github.com/cvfile/cv
@@ -15,8 +15,9 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.10
-Requires-Dist: cvfile<2,>=0.1
+Requires-Dist: cvfile<2,>=0.3.2
 Requires-Dist: haystack-ai<3,>=2.8
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0; extra == 'dev'
@@ -63,6 +64,20 @@ alternates and supplements:
 converter = CVFileToDocument(primary_only=True)
 ```
 
+### Untrusted files
+
+By default the converter runs `cvfile.validate()` on every source before
+extracting anything. Files carrying forbidden active content (JavaScript,
+launch or submit actions, external references), encryption, integrity digest
+mismatches, or payloads over the spec size cap make `run()` raise
+`ValueError` listing the issue codes. Resumes are classic untrusted input,
+so keep the default when converting files you did not produce yourself.
+
+```python
+converter = CVFileToDocument()              # verify=True (default)
+converter = CVFileToDocument(verify=False)  # trusted files only
+```
+
 ### Pipeline use
 
 ```python

{cvfile_haystack-0.2.0 → cvfile_haystack-0.3.2}/README.md

@@ -38,6 +38,20 @@ alternates and supplements:
 converter = CVFileToDocument(primary_only=True)
 ```
 
+### Untrusted files
+
+By default the converter runs `cvfile.validate()` on every source before
+extracting anything. Files carrying forbidden active content (JavaScript,
+launch or submit actions, external references), encryption, integrity digest
+mismatches, or payloads over the spec size cap make `run()` raise
+`ValueError` listing the issue codes. Resumes are classic untrusted input,
+so keep the default when converting files you did not produce yourself.
+
+```python
+converter = CVFileToDocument()              # verify=True (default)
+converter = CVFileToDocument(verify=False)  # trusted files only
+```
+
 ### Pipeline use
 
 ```python

{cvfile_haystack-0.2.0 → cvfile_haystack-0.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cvfile-haystack"
-version = "0.2.0"
+version = "0.3.2"
 description = "Haystack integration for the .cv open file format."
 readme = "README.md"
 license = { text = "Apache-2.0" }
@@ -19,9 +19,10 @@ classifiers = [
   "Programming Language :: Python :: 3.11",
   "Programming Language :: Python :: 3.12",
   "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3.14",
 ]
 dependencies = [
-  "cvfile>=0.1,<2",
+  "cvfile>=0.3.2,<2",
   "haystack-ai>=2.8,<3",
 ]
 

{cvfile_haystack-0.2.0 → cvfile_haystack-0.3.2}/src/haystack_integrations/components/converters/cvfile/converter.py

@@ -5,11 +5,12 @@ from __future__ import annotations
 from pathlib import Path
 from typing import Any
 
-from cvfile import CvFile, ExtractedPayload, extract
 from haystack import Document, component, logging
 from haystack.components.converters.utils import get_bytestream_from_source, normalize_metadata
 from haystack.dataclasses import ByteStream
 
+from cvfile import CvFile, ExtractedPayload, extract, validate
+
 logger = logging.getLogger(__name__)
 
 _TEXT_MIME_PREFIXES: tuple[str, ...] = (
@@ -35,6 +36,24 @@ def _payload_meta(payload: ExtractedPayload, file: CvFile) -> dict[str, Any]:
     }
 
 
+def _verify_cv(data: bytes, source: str) -> None:
+    """Refuse to convert a .cv file that fails ``cvfile.validate()`` (lenient level).
+
+    Validation rejects forbidden active content (JavaScript, launch and submit
+    actions, external references), encryption, integrity digest mismatches, and
+    payloads over the spec size cap, which is the right default for untrusted
+    input.
+    """
+    report = validate(data)
+    if report.ok:
+        return
+    codes = ", ".join(sorted({issue.code for issue in report.issues if issue.level == "error"}))
+    raise ValueError(
+        f".cv validation failed for {source}: {codes}. "
+        "The file was rejected before extraction; pass verify=False only for trusted files."
+    )
+
+
 def _resolve_chunks(file: CvFile) -> list:
     """Decode the file's embeddings.cbor into text-resolved chunks.
 
@@ -83,9 +102,18 @@ class CVFileToDocument:
     UTF-8 byte offsets. Files without an embeddings payload fall back to a single
     Markdown ``Document``. In ``mode="chunks"`` the ``primary_only`` flag is
     ignored (chunks already index a single text payload).
+
+    By default (``verify=True``) each source is checked with
+    ``cvfile.validate()`` before extraction: files carrying forbidden active
+    content (JavaScript, launch or submit actions, external references),
+    encryption, integrity digest mismatches, or oversized payloads make
+    ``run()`` raise ``ValueError`` listing the issue codes. Unlike unreadable
+    sources, which are logged and skipped, a validation failure is a security
+    signal and is never silently dropped. Set ``verify=False`` to skip the
+    check for trusted files only.
     """
 
-    def __init__(self, primary_only: bool = False, *, mode: str = "payloads") -> None:
+    def __init__(self, primary_only: bool = False, *, mode: str = "payloads", verify: bool = True) -> None:
         """Create a CVFileToDocument component.
 
         :param primary_only:
@@ -97,11 +125,16 @@ class CVFileToDocument:
             ``"payloads"`` (default) emits one ``Document`` per textual payload.
             ``"chunks"`` emits one ``Document`` per pre-computed embedding chunk
             with its vector attached.
+        :param verify:
+            If ``True`` (default), run ``cvfile.validate()`` on every source
+            and raise ``ValueError`` when a file fails validation. Set to
+            ``False`` only for trusted files.
         """
         if mode not in ("payloads", "chunks"):
             raise ValueError("mode must be 'payloads' or 'chunks'")
         self.primary_only = primary_only
         self.mode = mode
+        self.verify = verify
 
     @component.output_types(documents=list[Document])
     def run(
@@ -120,6 +153,11 @@ class CVFileToDocument:
             inputs (the same dictionary is merged into every document
             produced from that source).
 
+        :raises ValueError:
+            When ``verify=True`` (the default) and a source fails
+            ``cvfile.validate()``. The message lists the validation issue
+            codes.
+
         :returns:
             A dictionary with key ``documents`` containing the list of
             ``Document`` objects extracted from every source.
@@ -134,6 +172,9 @@ class CVFileToDocument:
                 logger.warning("Could not read {source}. Skipping it. Error: {error}", source=source, error=e)
                 continue
 
+            if self.verify:
+                _verify_cv(bytestream.data, str(source))
+
             try:
                 file = extract(bytestream.data)
             except Exception as e:

{cvfile_haystack-0.2.0 → cvfile_haystack-0.3.2}/tests/test_converter.py

@@ -12,6 +12,7 @@ from haystack_integrations.components.converters.cvfile import CVFileToDocument
 
 FIXTURE = Path(__file__).parents[3] / "packages" / "sdk-js" / "tests" / "fixtures" / "python-produced.cv"
 UNICODE_FIXTURE = Path(__file__).parents[2] / "tests" / "fixtures" / "unicode.cv"
+MALICIOUS_FIXTURE = Path(__file__).parents[3] / "spec" / "test-vectors" / "malicious" / "js-action.cv"
 
 
 @pytest.fixture(scope="module")
@@ -71,11 +72,14 @@ def test_accepts_bytestream() -> None:
 
 
 def test_unreadable_source_is_skipped(tmp_path: Path) -> None:
-    converter = CVFileToDocument()
+    """Parse failures are logged and skipped when verification is off; with
+    verify=True (default) the same garbage fails validation and raises."""
     not_a_cv = tmp_path / "garbage.cv"
     not_a_cv.write_bytes(b"not a real cv file")
-    result = converter.run(sources=[not_a_cv])
+    result = CVFileToDocument(verify=False).run(sources=[not_a_cv])
     assert result["documents"] == []
+    with pytest.raises(ValueError, match="pdf-parse-failed"):
+        CVFileToDocument().run(sources=[not_a_cv])
 
 
 def test_chunks_mode_attaches_a_vector_per_chunk() -> None:
@@ -95,6 +99,28 @@ def test_invalid_mode_rejected() -> None:
         CVFileToDocument(mode="bogus")
 
 
+def test_verify_rejects_malicious_file() -> None:
+    if not MALICIOUS_FIXTURE.exists():
+        pytest.skip(f"fixture not found: {MALICIOUS_FIXTURE}")
+    with pytest.raises(ValueError, match="javascript-action"):
+        CVFileToDocument().run(sources=[MALICIOUS_FIXTURE])
+
+
+def test_verify_false_converts_malicious_file() -> None:
+    if not MALICIOUS_FIXTURE.exists():
+        pytest.skip(f"fixture not found: {MALICIOUS_FIXTURE}")
+    docs = CVFileToDocument(verify=False).run(sources=[MALICIOUS_FIXTURE])["documents"]
+    assert len(docs) >= 1
+
+
+def test_verify_default_passes_on_valid_file() -> None:
+    if not FIXTURE.exists():
+        pytest.skip(f"fixture not found: {FIXTURE}")
+    converter = CVFileToDocument()
+    assert converter.verify is True
+    assert len(converter.run(sources=[FIXTURE])["documents"]) >= 1
+
+
 def test_non_ascii_chunk_text_slices_on_byte_offsets() -> None:
     if not UNICODE_FIXTURE.exists():
         pytest.skip(f"fixture not found: {UNICODE_FIXTURE}")