databricks-tellr-app 0.4.3.dev3401__tar.gz → 0.4.3.dev3403__tar.gz

{databricks_tellr_app-0.4.3.dev3401 → databricks_tellr_app-0.4.3.dev3403}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.3.dev3401
+Version: 0.4.3.dev3403
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.3.dev3401 → databricks_tellr_app-0.4.3.dev3403}/databricks_tellr_app.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.3.dev3401
+Version: 0.4.3.dev3403
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.3.dev3401 → databricks_tellr_app-0.4.3.dev3403}/databricks_tellr_app.egg-info/SOURCES.txt

@@ -124,6 +124,7 @@ setup.py
 ./src/services/pptx_prompts_defaults.py
 ./src/services/profile_service.py
 ./src/services/streaming_callback.py
+./src/services/svg_sanitizer.py
 ./src/services/validator.py
 ./src/services/converter_jail/__init__.py
 ./src/services/converter_jail/ast_guard.py
@@ -286,6 +287,7 @@ src/services/pptx_from_records.py
 src/services/pptx_prompts_defaults.py
 src/services/profile_service.py
 src/services/streaming_callback.py
+src/services/svg_sanitizer.py
 src/services/validator.py
 src/services/converter_jail/__init__.py
 src/services/converter_jail/ast_guard.py

{databricks_tellr_app-0.4.3.dev3401 → databricks_tellr_app-0.4.3.dev3403}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "databricks-tellr-app"
-version = "0.4.3.dev3401"
+version = "0.4.3.dev3403"
 description = "Tellr application package for Databricks Apps"
 readme = "README.md"
 requires-python = ">=3.10"

{databricks_tellr_app-0.4.3.dev3401 → databricks_tellr_app-0.4.3.dev3403}/src/api/routes/chat.py

@@ -25,6 +25,7 @@ from src.api.schemas.agent_config import normalize_style_source_exclusivity
 from src.api.schemas.requests import ChatRequest
 from src.api.schemas.responses import ChatResponse
 from src.api.schemas.streaming import StreamEvent, StreamEventType
+from src.api.routes._authz import _check_deck_permission_for_session
 from src.api.services.chat_service import get_chat_service
 from src.api.services.job_queue import enqueue_job
 from src.api.services.session_manager import SessionNotFoundError, get_session_manager
@@ -120,32 +121,6 @@ def _check_chat_permission(session_id: str, db: DBSession) -> None:
     )
 
 
-def _require_chat_request_owner(session_id: str) -> None:
-    """Allow polling only for the session that owns the chat request.
-
-    ChatRequest rows are bound to a session, and conversations are private
-    (same rule as ``GET /api/sessions/{id}/messages``): only the session
-    creator may read them. A viewer's contributor session is a different
-    session with a different creator, so deck-level CAN_VIEW is not enough.
-
-    Raises:
-        HTTPException 404: Session no longer exists.
-        HTTPException 403: Caller is not the session creator.
-    """
-    session_manager = get_session_manager()
-    try:
-        session_info = session_manager.get_session(session_id)
-    except SessionNotFoundError:
-        raise HTTPException(status_code=404, detail="Request not found")
-
-    current_user = get_current_user()
-    if not current_user or session_info.get("created_by") != current_user:
-        raise HTTPException(
-            status_code=403,
-            detail="Conversations are private. Only the session creator can view chat events.",
-        )
-
-
 def _apply_org_default_style_source(
     agent_config_data: dict,
     *,
@@ -696,21 +671,21 @@ async def poll_chat(
         Dictionary with status, events, last_message_id, and result
 
     Raises:
-        HTTPException: 404 if request not found, 403 if caller is not the
-            session creator
+        HTTPException: 404 if request not found
     """
     session_manager = get_session_manager()
 
     # SDR-4437 (chat-poll IDOR): a request_id must not grant access to another
     # user's chat events/result. ChatRequest rows are session-bound — resolve
-    # the session and require the caller to be its creator (F-CR-31: same
-    # privacy rule as /messages; deck CAN_VIEW must not expose chat events).
+    # the session and require CAN_VIEW on the deck.
     session_id = await asyncio.to_thread(
         session_manager.get_session_id_for_request, request_id
     )
     if session_id is None:
         raise HTTPException(status_code=404, detail="Request not found")
-    await asyncio.to_thread(_require_chat_request_owner, session_id)
+    await asyncio.to_thread(
+        _check_deck_permission_for_session, session_id, PermissionLevel.CAN_VIEW
+    )
 
     chat_request = await asyncio.to_thread(
         session_manager.get_chat_request, request_id

{databricks_tellr_app-0.4.3.dev3401 → databricks_tellr_app-0.4.3.dev3403}/src/services/design_system_service.py

@@ -74,6 +74,7 @@ from src.database.models.design_system import (
     DesignSystemToken,
 )
 from src.services.design_system_compiler import recompute_compiled_style_content
+from src.services.svg_sanitizer import looks_like_svg, sanitize_svg
 
 logger = logging.getLogger(__name__)
 
@@ -2164,6 +2165,20 @@ def _collect_assets_and_files(
                 mime = sniffed
             else:
                 mime = _guess_mime(rel)
+                if mime == "image/svg+xml":
+                    try:
+                        data = sanitize_svg(data)
+                    except ValueError as exc:
+                        raise DesignSystemImportError(
+                            f"Bundle entry '{rel}' is not a valid SVG: {exc}"
+                        ) from exc
+                elif looks_like_svg(data):
+                    # Extension says raster/font/etc. but the bytes are SVG:
+                    # never trust the name to skip sanitization.
+                    raise DesignSystemImportError(
+                        f"Bundle entry '{rel}' contains SVG content but does not "
+                        "have an .svg extension"
+                    )
             width, height = _image_dimensions(data, mime)
             asset = DesignSystemAsset(
                 kind=kind,

{databricks_tellr_app-0.4.3.dev3401 → databricks_tellr_app-0.4.3.dev3403}/src/services/image_service.py

@@ -11,6 +11,7 @@ from sqlalchemy.dialects.postgresql import JSONB
 from sqlalchemy.orm import Query, Session
 
 from src.database.models.image import ImageAsset
+from src.services.svg_sanitizer import looks_like_svg, sanitize_svg
 
 logger = logging.getLogger(__name__)
 
@@ -41,6 +42,20 @@ def upload_image(
     if len(file_content) > MAX_FILE_SIZE:
         raise ValueError(f"File too large: {len(file_content)} bytes (max {MAX_FILE_SIZE})")
 
+    # The client-declared MIME type is untrusted: decide on the CONTENT.
+    # SVG can carry script, so it is always sanitized; SVG bytes declared as
+    # any other type are rejected rather than stored under a raster label.
+    if mime_type == "image/svg+xml":
+        try:
+            file_content = sanitize_svg(file_content)
+        except ValueError as exc:
+            raise ValueError(f"Invalid SVG upload: {exc}") from exc
+    elif looks_like_svg(file_content):
+        raise ValueError(
+            f"File content is SVG but was declared as {mime_type}; "
+            "upload it as image/svg+xml."
+        )
+
     # Check for duplicate original_filename among active images (case-insensitive).
     # Ephemeral images (paste-to-chat) skip this check — they use throwaway names
     # and should never block each other.

databricks_tellr_app-0.4.3.dev3403/src/services/svg_sanitizer.py

@@ -0,0 +1,414 @@
+"""Server-side sanitization for SVG images before they are stored."""
+
+from __future__ import annotations
+
+import re
+from urllib.parse import urlsplit
+
+from lxml import etree  # type: ignore[import-untyped]
+
+SVG_NAMESPACE = "http://www.w3.org/2000/svg"
+
+_ALLOWED_ELEMENTS = frozenset(
+    {
+        "svg",
+        "g",
+        "defs",
+        "symbol",
+        "use",
+        "title",
+        "desc",
+        "switch",
+        "view",
+        "path",
+        "rect",
+        "circle",
+        "ellipse",
+        "line",
+        "polyline",
+        "polygon",
+        "text",
+        "tspan",
+        "textPath",
+        "a",
+        "image",
+        "style",
+        "linearGradient",
+        "radialGradient",
+        "stop",
+        "pattern",
+        "marker",
+        "mask",
+        "clipPath",
+        "filter",
+        "feBlend",
+        "feColorMatrix",
+        "feComponentTransfer",
+        "feComposite",
+        "feConvolveMatrix",
+        "feDiffuseLighting",
+        "feDisplacementMap",
+        "feDistantLight",
+        "feDropShadow",
+        "feFlood",
+        "feFuncA",
+        "feFuncB",
+        "feFuncG",
+        "feFuncR",
+        "feGaussianBlur",
+        "feImage",
+        "feMerge",
+        "feMergeNode",
+        "feMorphology",
+        "feOffset",
+        "fePointLight",
+        "feSpecularLighting",
+        "feSpotLight",
+        "feTile",
+        "feTurbulence",
+        "animate",
+        "animateMotion",
+        "animateTransform",
+        "set",
+        "mpath",
+    }
+)
+
+_ALLOWED_ATTRIBUTES = frozenset(
+    {
+        "id",
+        "class",
+        "style",
+        "transform",
+        "transform-origin",
+        "clip-path",
+        "clip-rule",
+        "mask",
+        "filter",
+        "opacity",
+        "fill",
+        "fill-opacity",
+        "fill-rule",
+        "stroke",
+        "stroke-dasharray",
+        "stroke-dashoffset",
+        "stroke-linecap",
+        "stroke-linejoin",
+        "stroke-miterlimit",
+        "stroke-opacity",
+        "stroke-width",
+        "paint-order",
+        "color",
+        "color-interpolation",
+        "color-interpolation-filters",
+        "display",
+        "visibility",
+        "systemLanguage",
+        "requiredFeatures",
+        "requiredExtensions",
+        "lang",
+        "space",
+        "role",
+        "tabindex",
+        "version",
+        "baseProfile",
+        "width",
+        "height",
+        "viewBox",
+        "preserveAspectRatio",
+        "x",
+        "y",
+        "dx",
+        "dy",
+        "zoomAndPan",
+        "d",
+        "points",
+        "rx",
+        "ry",
+        "cx",
+        "cy",
+        "r",
+        "x1",
+        "x2",
+        "y1",
+        "y2",
+        "rotate",
+        "textLength",
+        "lengthAdjust",
+        "font-family",
+        "font-size",
+        "font-style",
+        "font-variant",
+        "font-weight",
+        "letter-spacing",
+        "word-spacing",
+        "text-decoration",
+        "text-anchor",
+        "dominant-baseline",
+        "alignment-baseline",
+        "baseline-shift",
+        "writing-mode",
+        "gradientUnits",
+        "gradientTransform",
+        "spreadMethod",
+        "href",
+        "offset",
+        "stop-color",
+        "stop-opacity",
+        "patternUnits",
+        "patternContentUnits",
+        "patternTransform",
+        "markerWidth",
+        "markerHeight",
+        "markerUnits",
+        "refX",
+        "refY",
+        "orient",
+        "clipPathUnits",
+        "maskUnits",
+        "maskContentUnits",
+        "filterUnits",
+        "primitiveUnits",
+        "in",
+        "in2",
+        "result",
+        "mode",
+        "values",
+        "type",
+        "tableValues",
+        "slope",
+        "intercept",
+        "amplitude",
+        "exponent",
+        "k1",
+        "k2",
+        "k3",
+        "k4",
+        "operator",
+        "radius",
+        "stdDeviation",
+        "xChannelSelector",
+        "yChannelSelector",
+        "scale",
+        "flood-color",
+        "flood-opacity",
+        "kernelMatrix",
+        "divisor",
+        "bias",
+        "targetX",
+        "targetY",
+        "edgeMode",
+        "kernelUnitLength",
+        "preserveAlpha",
+        "lighting-color",
+        "surfaceScale",
+        "diffuseConstant",
+        "specularConstant",
+        "specularExponent",
+        "pointsAtX",
+        "pointsAtY",
+        "pointsAtZ",
+        "limitingConeAngle",
+        "azimuth",
+        "elevation",
+        "seed",
+        "numOctaves",
+        "baseFrequency",
+        "stitchTiles",
+        "attributeName",
+        "attributeType",
+        "begin",
+        "end",
+        "dur",
+        "repeatCount",
+        "repeatDur",
+        "from",
+        "to",
+        "by",
+        "keyTimes",
+        "keySplines",
+        "keyPoints",
+        "calcMode",
+        "additive",
+        "accumulate",
+        "path",
+        "startOffset",
+        "method",
+        "spacing",
+        "crossorigin",
+        "decoding",
+        "loading",
+        "target",
+        "download",
+        "rel",
+    }
+)
+
+_URL_ATTRIBUTES = frozenset({"href"})
+_ANIMATION_ELEMENTS = frozenset({"animate", "animateMotion", "animateTransform", "set"})
+_ANIMATION_FORBIDDEN_TARGETS = frozenset({"href", "style"})
+_SAFE_DATA_IMAGE_TYPES = frozenset({"png", "jpeg", "jpg", "gif", "webp"})
+_UNSAFE_URL_PATTERN = re.compile(
+    r"(?:javascript|vbscript|livescript|mocha):|data:image/svg\+xml",
+    re.IGNORECASE,
+)
+
+
+def _local_name(value: str) -> str:
+    return value.rsplit("}", 1)[-1].rsplit(":", 1)[-1]
+
+
+def _element_local_name(element: etree._Element) -> str:
+    return etree.QName(element).localname
+
+
+def _is_allowed_element(element: etree._Element) -> bool:
+    return _element_local_name(element) in _ALLOWED_ELEMENTS
+
+
+def _normalized_url(value: str) -> str:
+    characters = (character for character in value if character not in "\t\n\r\f\v")
+    return "".join(characters).strip()
+
+
+def _is_safe_url(value: str) -> bool:
+    normalized = _normalized_url(value)
+    if not normalized or normalized.startswith("#"):
+        return True
+
+    parsed = urlsplit(normalized)
+    scheme = parsed.scheme.lower()
+    if not scheme or scheme in {"http", "https", "mailto"}:
+        return True
+    if scheme != "data":
+        return False
+
+    media_type = parsed.path.split(";", 1)[0].lower()
+    image_type = media_type.removeprefix("image/")
+    return image_type in _SAFE_DATA_IMAGE_TYPES
+
+
+def _has_external_use_reference(element: etree._Element) -> bool:
+    return any(
+        _local_name(name) == "href" and not _normalized_url(value).startswith("#")
+        for name, value in element.attrib.items()
+    )
+
+
+def _animation_targets_forbidden_attribute(element: etree._Element) -> bool:
+    target = element.get("attributeName")
+    if target is None:
+        return False
+    local_target = _local_name(target)
+    return local_target.startswith("on") or local_target in _ANIMATION_FORBIDDEN_TARGETS
+
+
+def _contains_unsafe_url(value: str) -> bool:
+    return _UNSAFE_URL_PATTERN.search(_normalized_url(value)) is not None
+
+
+def _sanitize_attributes(root: etree._Element) -> None:
+    for element in root.iter():
+        for name, value in list(element.attrib.items()):
+            local_name = _local_name(name)
+            if local_name not in _ALLOWED_ATTRIBUTES:
+                del element.attrib[name]
+                continue
+            if local_name in _URL_ATTRIBUTES and not _is_safe_url(value):
+                del element.attrib[name]
+            elif local_name == "style" and _contains_unsafe_url(value):
+                del element.attrib[name]
+
+        if _element_local_name(element) == "style" and _contains_unsafe_url(
+            element.text or ""
+        ):
+            element.text = None
+
+
+_RASTER_MAGICS = (
+    b"\x89PNG\r\n\x1a\n",
+    b"\xff\xd8\xff",
+    b"GIF87a",
+    b"GIF89a",
+)
+_SNIFF_WINDOW = 4096
+# An SVG document: optional BOM/whitespace, any XML prolog (declaration, comments,
+# PIs, DOCTYPE with optional internal subset), then ``<svg`` as the ROOT element.
+# Anchoring on the root (not a substring) keeps CSS/HTML/text that merely mentions
+# ``<svg`` (e.g. a ``data:image/svg+xml,<svg ...>`` URI) from being treated as SVG.
+_SVG_ROOT_RE = re.compile(
+    r"\A\ufeff?\s*"
+    r"(?:<\?.*?\?>\s*|<!--.*?-->\s*|<!DOCTYPE(?:[^>\[]|\[.*?\])*>\s*)*"
+    r"<(?:[\w.-]+:)?svg[\s/>]",
+    re.IGNORECASE | re.DOTALL,
+)
+
+
+def looks_like_svg(content: bytes) -> bool:
+    """Content sniff: True if the bytes look like an SVG document.
+
+    Used so a client-declared MIME type (e.g. ``image/png``) is never trusted
+    to decide whether sanitization is needed. Content that starts with a known
+    raster magic number is not SVG; otherwise it is SVG only if ``<svg`` is the
+    root element (after any XML prolog) within the first few KB (UTF-8/ASCII or
+    BOM-marked UTF-16).
+    """
+    head = content[:_SNIFF_WINDOW]
+    if head.startswith(_RASTER_MAGICS):
+        return False
+    if head.startswith((b"\xff\xfe", b"\xfe\xff")):
+        text = head.decode("utf-16", errors="ignore")
+    else:
+        text = head.decode("utf-8", errors="ignore")
+    return _SVG_ROOT_RE.match(text) is not None
+
+
+def sanitize_svg(content: bytes) -> bytes:
+    """Return a sanitized SVG, rejecting malformed or non-SVG XML input."""
+    parser = etree.XMLParser(
+        resolve_entities=False,
+        no_network=True,
+        load_dtd=False,
+        huge_tree=False,
+        remove_comments=True,
+        remove_pis=True,
+    )
+
+    try:
+        root = etree.fromstring(content, parser=parser)
+    except etree.XMLSyntaxError as exc:
+        raise ValueError("SVG must be well-formed XML") from exc
+
+    if root is None:
+        raise ValueError("SVG document is empty")
+
+    root_qname = etree.QName(root)
+    if root_qname.localname != "svg" or root_qname.namespace not in {None, SVG_NAMESPACE}:
+        raise ValueError("SVG root element is required")
+
+    if root.getroottree().docinfo.doctype:
+        raise ValueError("SVG DOCTYPE declarations are not allowed")
+
+    elements_to_remove = []
+    for element in root.iter():
+        if element is root:
+            continue
+
+        local_name = _element_local_name(element)
+        if not _is_allowed_element(element):
+            elements_to_remove.append(element)
+        elif local_name == "use" and _has_external_use_reference(element):
+            elements_to_remove.append(element)
+        elif local_name in _ANIMATION_ELEMENTS and _animation_targets_forbidden_attribute(
+            element
+        ):
+            elements_to_remove.append(element)
+
+    for element in elements_to_remove:
+        parent = element.getparent()
+        if parent is not None:
+            parent.remove(element)
+
+    _sanitize_attributes(root)
+
+    return etree.tostring(root, encoding="utf-8", xml_declaration=True)