bambuddy

mirror of https://github.com/maziggy/bambuddy.git synced 2026-09-30 03:01:21 +02:00

Files

T

maziggy 4416fd4577 fix(spoolman): allow LAN Spoolman in SSRF guard

The SSRF guard added in this PR rejected all RFC-1918 private and loopback
  addresses, which breaks Bambuddy's primary deployment topology — Spoolman
  running on the same LAN as Bambuddy (192.168.x.x, 10.x.x.x, 127.0.0.1).
  Users hit "Spoolman URL must not point to a private, loopback, link-local,
  multicast, or unspecified address" on legitimate setups.

  Rescope the guard to block what's actually dangerous in this context:
  cloud metadata endpoints (AWS/Alibaba IMDS), multicast, unspecified,
  non-http(s) schemes, and numeric-encoded IP bypasses. Loopback and
  RFC-1918 ranges are now explicitly permitted.

  Tests:
  - test_ssrf_blocked_schemes_and_addresses updated with refined block list
  - test_ssrf_allows_lan_spoolman_topologies (new) asserts loopback +
    RFC-1918 are accepted so this regression cannot recur silently
  - TestSpoolmanInventorySSRFSpoolBuddyPath parametrize lists trimmed

2026-04-24 14:18:58 +02:00

assets

fix(spoolman): allow LAN Spoolman in SSRF guard

2026-04-24 14:18:58 +02:00

icons

Updated CHANGELOG

2026-03-11 10:13:35 +01:00

img

feat(printer): add X2D support — camera, dual-nozzle, K-profile, maintenance (#988 )

2026-04-16 10:40:32 +02:00

index.html

fix(spoolman): allow LAN Spoolman in SSRF guard