Skip to content

Releases: Oaklight/veilrender

Release list

v0.3.1

v0.3.1 Latest
Latest

Choose a tag to compare

View all tags
@Oaklight Oaklight released this 04 Jul 05:52
v0.3.1
7921f85

Security Patch

Fixed (CRITICAL)

  • SSRF via file:// protocol — Playwright page.goto() accepted arbitrary schemes, allowing local file reads (e.g. /etc/passwd)
  • SSRF via localhost — http://127.0.0.1:9222 exposed CDP debug endpoints with WebSocket URLs enabling RCE
  • No URL validation — user-supplied URLs forwarded to Playwright without any sanitization

Fixed (MEDIUM)

  • data: URL injection — attacker could render arbitrary HTML content

Added

  • url_validator.py — scheme whitelist (http/https only), DNS resolution with private/reserved IP blocking (loopback, RFC1918, link-local, cloud metadata 169.254.x.x)
  • Fail2ban-style IP rate limiting — 3 auth failures in 5 min → 10 min ban, with X-Forwarded-For support

Changed

  • Reduce max_body_size from 10 MB to 64 KB
  • Promote blocked-request filter log from DEBUG to INFO

Upgrade strongly recommended. All users running VeilRender on shared/public networks should update immediately.

Full Changelog: v0.3.0...v0.3.1

Assets 2
Loading

v0.3.0

v0.3.0

Choose a tag to compare

View all tags
@Oaklight Oaklight released this 04 Jul 05:52
v0.3.0
0e7856a

What's New

Outbound Request Filtering

  • Block ad/tracker/malware domains at the Playwright level using StevenBlack/hosts community blocklist (~82k domains)
  • Enabled by default via VEILRENDER_RESOURCE_FILTER=true
  • make update-blocklist to refresh from jsDelivr CDN

Two-Tier Render Cache

  • L1: in-memory TTLCache for sub-millisecond hits
  • L2: S3-compatible persistent storage (Cloudflare R2, Oracle Object Storage, AWS S3) via minio client
  • L2 TTL enforcement via embedded _stored_at timestamp
  • S3 lifecycle rule auto-set on startup (7× TTL as bulk cleanup safety net)
  • Disabled by default; enable with VEILRENDER_CACHE_ENABLED=true + S3 env vars

New Environment Variables

  • VEILRENDER_RESOURCE_FILTER — toggle ad/tracker blocking (default: true)
  • VEILRENDER_CACHE_ENABLED — enable render caching (default: false)
  • VEILRENDER_CACHE_TTL — cache TTL in seconds (default: 86400)
  • VEILRENDER_S3_ENDPOINT, VEILRENDER_S3_ACCESS_KEY, VEILRENDER_S3_SECRET_KEY, VEILRENDER_S3_BUCKET, VEILRENDER_S3_REGION, VEILRENDER_S3_SECURE

Full Changelog: v0.2.0...v0.3.0

Loading

v0.2.0

v0.2.0

Choose a tag to compare

View all tags
@clementine-oaklight clementine-oaklight released this 13 Jun 15:28
v0.2.0
4bc4d92

What's Changed

  • feat: improve dashboard UI with badges and responsive layout by @clementine-oaklight[bot] in #20

Full Changelog: v0.1.0...v0.2.0

Loading

v0.1.0

v0.1.0

Choose a tag to compare

View all tags
@Oaklight Oaklight released this 13 Jun 01:31
v0.1.0
ded2859

VeilRender v0.1.0

Initial release — headless browser rendering API.

Features

  • /render — render a URL, return HTML / Markdown / readability content
  • /screenshot — capture a screenshot of a URL
  • Token-based authentication
  • Configurable concurrency, timeout, and viewport via environment variables
  • Zero external dependencies (vendored modules)

Install

# Docker
docker run -p 7860:7860 -e VEILRENDER_API_TOKEN=your-secret oaklight/veilrender

# PyPI
pip install veilrender

Links

Loading