mirror of
https://github.com/maziggy/bambuddy.git
synced 2026-09-30 19:21:33 +02:00
maziggy
4b3b615a2c
Security scan (Bandit) identified vulnerable XML parsing in 3MF file processing. The standard xml.etree.ElementTree is vulnerable to XXE (XML External Entity) attacks. Changes: - Add defusedxml>=0.7.0 to requirements.txt - Replace all xml.etree.ElementTree imports with defusedxml.ElementTree in production code (6 files) Affected files: - backend/app/services/archive.py - backend/app/services/print_scheduler.py - backend/app/api/routes/print_queue.py - backend/app/api/routes/library.py - backend/app/api/routes/printers.py - backend/app/api/routes/archives.py Test files intentionally left unchanged (test XML is trusted).
59 lines
1004 B
Plaintext
59 lines
1004 B
Plaintext
# Web Framework
|
|
fastapi>=0.109.0
|
|
uvicorn[standard]>=0.27.0
|
|
|
|
# Database
|
|
sqlalchemy>=2.0.0
|
|
aiosqlite>=0.19.0
|
|
greenlet>=3.0.0
|
|
|
|
# Pydantic
|
|
pydantic>=2.0.0
|
|
pydantic-settings>=2.0.0
|
|
|
|
# Bambu Lab Printer Communication
|
|
paho-mqtt>=2.0.0
|
|
aioftp>=0.22.0
|
|
|
|
# Virtual Printer (emulates Bambu printer for slicer uploads)
|
|
pyftpdlib>=2.0.0
|
|
cryptography>=41.0.0
|
|
|
|
# 3MF Processing (standard zipfile is sufficient for Bambu 3MF files)
|
|
defusedxml>=0.7.0 # Safe XML parsing (prevents XXE attacks)
|
|
|
|
# Excel Export
|
|
openpyxl>=3.1.0
|
|
|
|
# Notifications
|
|
pywebpush>=2.0.0
|
|
|
|
# Utilities
|
|
python-multipart>=0.0.6
|
|
aiofiles>=23.0.0
|
|
|
|
# QR Code generation
|
|
qrcode[pil]>=7.4.0
|
|
|
|
# STL Thumbnail Generation
|
|
trimesh>=4.0.0
|
|
matplotlib>=3.8.0
|
|
fast-simplification>=0.1.0
|
|
|
|
# System monitoring
|
|
psutil>=6.0.0
|
|
|
|
# Authentication
|
|
PyJWT>=2.8.0
|
|
passlib[bcrypt]>=1.7.4
|
|
|
|
# Plate Detection (optional - enables build plate empty detection)
|
|
opencv-python-headless>=4.8.0
|
|
numpy>=1.24.0
|
|
|
|
# Development
|
|
pytest>=8.0.0
|
|
pytest-asyncio>=0.23.0
|
|
httpx>=0.26.0
|
|
ruff>=0.2.0
|