mirror of
https://github.com/0xMassi/webclaw.git
synced 2026-06-06 22:05:13 +02:00
be8bcfebd9
Security audit follow-up across the workspace: - webclaw-core: keep the crate WASM-safe. quickjs/rquickjs is now a cfg(not(wasm32)) target dependency and the extraction entry point uses a direct call on wasm instead of spawning a thread, so it builds and runs on wasm32 with or without default features. - webclaw-core: bound the structured-data scrubber recursion (depth cap) so deeply nested attacker JSON-LD / __NEXT_DATA__ cannot exhaust the stack. - webclaw-fetch: stream the response body with a running ceiling so a small highly compressed payload cannot inflate to gigabytes in memory; redact user:pass@ from proxy URLs before they reach error strings. - webclaw-cli: contain output filenames inside the chosen directory (reject .. / absolute, drop traversal path segments), run --webhook URLs through the public-URL SSRF guard, clamp --watch-interval to >=1s, and make research slug truncation char-safe. - webclaw-mcp: char-safe slug truncation (no multibyte slice panic). - setup.sh / deploy/hetzner.sh: replace eval on read input with printf -v, and mask auth key / API token in console output. - CI: enforce the wasm32 build invariant for webclaw-core. Tests added for every behavioral change. Bump to 0.6.3 + CHANGELOG.
31 lines
882 B
TOML
31 lines
882 B
TOML
[package]
|
|
name = "webclaw-core"
|
|
description = "Pure HTML content extraction engine for LLMs"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
|
|
[features]
|
|
default = ["quickjs"]
|
|
quickjs = ["rquickjs"]
|
|
|
|
[dependencies]
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
tracing = { workspace = true }
|
|
scraper = "0.22"
|
|
ego-tree = "0.10"
|
|
url = { version = "2", features = ["serde"] }
|
|
regex = "1"
|
|
once_cell = "1"
|
|
similar = "2"
|
|
|
|
# rquickjs links a C library and cannot build for wasm32. Gating it per
|
|
# target keeps the `quickjs` feature usable on native while leaving the
|
|
# crate WASM-safe even with default features enabled.
|
|
[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
|
|
rquickjs = { version = "0.9", features = ["classes", "properties"], optional = true }
|
|
|
|
[dev-dependencies]
|
|
tokio = { workspace = true }
|