Exact

Exact Union RegExp

mateo-berri ac29505f3d feat(proxy): enforce vector-store upload security controls on /v1/rag/ingest ... Uploaded files reaching the RAG ingest path were trusted by client filename and content-type, so archives and executable scripts were ingested and malicious content was never screened. Enforce controls at the upload boundary before the file leaves the proxy: - classify content by magic bytes and a strict UTF-8 decode, never by the client filename or content-type - allowlist PDF and UTF-8 text; reject archives and executables/scripts - cap upload size (512MB) via a bounded read - run every accepted upload through a dependency-injected malware scanner, failing closed on scan error; the default scanner flags the EICAR test file so the hook is validated end to end - give accepted uploads a server-generated filename so the client name never reaches storage - set Content-Disposition attachment and X-Content-Type-Options nosniff on vector-store file downloads		2026-08-24 12:41:15 -07:00
..
__init__.py	tests and route permissions (#21508)	2026-02-18 16:58:38 -08:00
test_rag_endpoints.py	feat(proxy): enforce vector-store upload security controls on /v1/rag/ingest	2026-08-24 12:41:15 -07:00
test_upload_security.py	feat(proxy): enforce vector-store upload security controls on /v1/rag/ingest	2026-08-24 12:41:15 -07:00