Skip to content

evaluation-harness v0.4.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Oct 22:11
· 44 commits to main since this release
v0.4.3
75694ba
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A security fix to the inspector: evh catalog-serve no longer serves files through /api/.
Upgrade if you run it where anyone else can reach it. No result moves.

Fixed

  • Nothing is read through /api/. A path under /api/ skipped the server's path checks
    and fell through to the file server, so /api/../.env, encoded or not, returned files from
    the project root, keys included. This happened in local and in --public mode. Now a ..
    anywhere in a path is refused first, and only the API's three endpoints (/api/health,
    /api/compare, /api/item) answer under /api/. Any other /api/ path is 404. In
    --public mode no path outside the API serves a file.
  • --hooks see one route for every unknown /api/ path. It is named /api/other, so
    someone asking for many made-up paths cannot create a metric series for each.

Install

pip install "evaluation-harness @ git+https://github.com/chipi/eval-harness@v0.4.3#subdirectory=harness"
Assets 4
Loading