121 releases 129 tags

RSS feed

• v0.39.0 90c7edde5d

  Compare

  0.39.0 — a fixture that carried what the fix was hiding Stable

  joeyr released this 2026-08-23 21:40:06 -05:00 | 94 commits to main since this release

  A real Canvas feed URL was committed by the release that fixed feed-URL redaction.

  0.38.0 taught safe_url that a Canvas secret lives in the filename, and pinned the
  lesson with a fixture captured verbatim from the boot log that revealed it. The test
  proving the credential is hidden carried the credential.

  Security

  • tests/test_feeds.py no longer contains a live capability URL. A calendar
    subscription URL is the whole authorisation: anyone holding it reads the calendar,
    with no login. Host and token are now synthetic, and the host names no institution.
    The URL that was committed is compromised regardless — a published history keeps
    the value, so the remedy is resetting the feed in Canvas.
  • The institution host is out of CHANGELOG.md too.

  Added

  • tests/test_no_pii.py now checks capability URLs and Canvas hosts. It had two
    rules — addresses at unreserved domains, and iCloud principal paths — and a feed URL
    is neither, so it passed the leak on every run since 0.38.0. A guard against two
    shapes is not a guard against a class.
  • The token rule uses case mixing, not entropy: a hand-written placeholder like
    abc123secret%40group clears "16 characters, 8 distinct" without trying, so an
    entropy rule would fail on the synthetic fixtures beside the real one. Both guards
    were proved by breaking them with invented values of the right shape.

  1300 tests green.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads