Repository navigation
Release 0.7.1: harden weigh-in photo paths, HACS install docs - #13
Merged
Merged
Conversation
added 3 commits
October 21, 2026 09:25
- The photo decoder treated any string naming an existing file as a path to copy into the photo store. The weigh_in / batch/import websocket commands and the record_weight / import_batch actions are open to every logged-in user, and batch/export with include_photos handed the copy back, so a non-admin could read /config/secrets.yaml or anything under .storage. - _photo_bytes now only decodes inline data (data URL or base64); an empty payload yields no photo instead of an empty file. - record_weight keeps accepting a local file path, resolved in services.py only: hass.config.is_allowed_path must accept it (allowlist_external_dirs, the camera.snapshot rule), the file is read off the event loop and passed down as a data URL. Anything else raises HomeAssistantError. - Tests cover the allowed path, the refused path, the shared decoder and the websocket commands ignoring even an allowlisted path; services.yaml, README and CHANGELOG document the rule. Reported in the HACS default-catalog review.
- Once Curing Chamber is in the default catalog users find it by searching HACS, so the steps start there (with a My Home Assistant button) and the custom-repository route becomes the fallback, in both languages.
- Bump manifest.json and pyproject.toml to 0.7.1. - CHANGELOG: move the Unreleased entries under 0.7.1 and update the compare links.
6 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses the HACS default-catalog review on hacs/default#11574.
weigh_in/batch/importwebsocket commands and therecord_weight/import_batchactions are open to every logged-in user, andbatch/exportwithinclude_photoshanded the copy back, so a non-admin could read/config/secrets.yamlor anything under.storage._photo_bytes(coordinator) now only decodes inline data (data URL or base64) and never touches the filesystem.record_weightkeeps accepting a local file path, resolved inservices.pyonly: it must passhass.config.is_allowed_path(allowlist_external_dirs, thecamera.snapshotrule), is read off the event loop and handed down as a data URL; anything else raisesHomeAssistantError. The websocket commands andimport_batchnever interpret a photo as a path.services.yaml, README and CHANGELOG document the path rule.Test plan
ruff check/ruff format --check/mypycleanpytestgreen (173 tests), coverage gate ≥ 85 % onregulation/andprogram/