mirror of
https://github.com/hanzoai/insights.git
synced 2026-11-02 14:32:45 +00:00
zeekay
1b367e2b62
The tree was a debranded snapshot of upstream taken around 2026-02-20, and upstream has moved about five months since. This replaces it with upstream master, mechanically re-derived: bin/debrand does the rename, and the pipeline and squashed migrations are restored from the shipped tree. Not a merge. The previous import replaced the tree wholesale in a single commit, so there is no shared content history to merge against. Reproducing the rename on the new tree is what actually converges. What survives: .hanzo/workflows, the Dockerfiles and bin/docker* entrypoints, compose files, LLM.md, and insights/migrations. The squashed initial migration is load-bearing — the live database records it by name, so upstream's ~918 individual migrations cannot come back. Nine products are dropped as unreferenced. Twenty-one more that we do not run are kept anyway because the core app still imports them; unpicking those is a refactor and does not belong in a rebase. This base does not build yet, and the reasons are not in the rename: upstream now wants Python 3.13.13 against our 3.12.12 and Django 5.2 against our 4.2, and the dependency manifests still name upstream packages that we republish under our own names. Those are decisions, not renames.
229 lines
5.2 KiB
JSON
229 lines
5.2 KiB
JSON
[
|
|
{
|
|
"name": "keeps allow-listed path segments, masks numbers",
|
|
"allow": {
|
|
"text": [],
|
|
"url": [
|
|
"users",
|
|
"profile"
|
|
]
|
|
},
|
|
"input": "https://example.com/users/42/profile",
|
|
"expected": "https://example.com/users/$$/profile"
|
|
},
|
|
{
|
|
"name": "redacts non-allow-listed path segments",
|
|
"allow": {
|
|
"text": [],
|
|
"url": []
|
|
},
|
|
"input": "/foo/bar?x=1",
|
|
"expected": "/[redacted]/[redacted]"
|
|
},
|
|
{
|
|
"name": "query param survives on allow-listed key, number value masked",
|
|
"allow": {
|
|
"text": [],
|
|
"url": [
|
|
"page"
|
|
]
|
|
},
|
|
"input": "https://example.com/?page=2&secret=abc",
|
|
"expected": "https://example.com/?page=$"
|
|
},
|
|
{
|
|
"name": "allow-listed fragment kept",
|
|
"allow": {
|
|
"text": [],
|
|
"url": [
|
|
"section"
|
|
]
|
|
},
|
|
"input": "https://example.com/#section",
|
|
"expected": "https://example.com/#section"
|
|
},
|
|
{
|
|
"name": "userinfo is stripped and the port masked; the host passes through",
|
|
"allow": {
|
|
"text": [],
|
|
"url": [
|
|
"us",
|
|
"path"
|
|
]
|
|
},
|
|
"input": "https://user:[email protected]:8080/path",
|
|
"expected": "https://us.example.org:[port]/path"
|
|
},
|
|
{
|
|
"name": "ipv4 host is masked",
|
|
"allow": {
|
|
"text": [],
|
|
"url": []
|
|
},
|
|
"input": "http://192.168.0.1/admin",
|
|
"expected": "http://[ip_address]/[redacted]"
|
|
},
|
|
{
|
|
"name": "bracketed ipv6 host and port are masked",
|
|
"allow": {
|
|
"text": [],
|
|
"url": []
|
|
},
|
|
"input": "https://[2001:db8::1]:8443/status",
|
|
"expected": "https://[ip_address]:[port]/[redacted]"
|
|
},
|
|
{
|
|
"name": "hex-encoded ipv4 host is masked",
|
|
"allow": {
|
|
"text": [],
|
|
"url": []
|
|
},
|
|
"input": "http://0xc0a80101/admin",
|
|
"expected": "http://[ip_address]/[redacted]"
|
|
},
|
|
{
|
|
"name": "octal-encoded ipv4 host and port are masked",
|
|
"allow": {
|
|
"text": [],
|
|
"url": []
|
|
},
|
|
"input": "http://0300.0250.0.1:8080/admin",
|
|
"expected": "http://[ip_address]:[port]/[redacted]"
|
|
},
|
|
{
|
|
"name": "query param with an allow-listed key and empty value survives",
|
|
"allow": {
|
|
"text": [],
|
|
"url": [
|
|
"ok"
|
|
]
|
|
},
|
|
"input": "https://example.com/?ok=&x=1",
|
|
"expected": "https://example.com/?ok="
|
|
},
|
|
{
|
|
"name": "bare (valueless) query flag survives only when allow-listed",
|
|
"allow": {
|
|
"text": [],
|
|
"url": [
|
|
"ok"
|
|
]
|
|
},
|
|
"input": "https://example.com/?ok&drop",
|
|
"expected": "https://example.com/?ok"
|
|
},
|
|
{
|
|
"name": "numeric fragment is dropped",
|
|
"allow": {
|
|
"text": [],
|
|
"url": []
|
|
},
|
|
"input": "https://example.com/#42",
|
|
"expected": "https://example.com/"
|
|
},
|
|
{
|
|
"name": "relative-path safe segments (. and ..) are preserved",
|
|
"allow": {
|
|
"text": [],
|
|
"url": []
|
|
},
|
|
"input": "/a/../b",
|
|
"expected": "/[redacted]/../[redacted]"
|
|
},
|
|
{
|
|
"name": "multiple surviving query params keep their order",
|
|
"allow": {
|
|
"text": [],
|
|
"url": [
|
|
"a",
|
|
"b",
|
|
"x",
|
|
"y"
|
|
]
|
|
},
|
|
"input": "https://example.com/?a=x&b=y",
|
|
"expected": "https://example.com/?a=x&b=y"
|
|
},
|
|
{
|
|
"name": "passthrough url literals survive: about:blank",
|
|
"allow": {
|
|
"text": [],
|
|
"url": []
|
|
},
|
|
"input": "about:blank",
|
|
"expected": "about:blank"
|
|
},
|
|
{
|
|
"name": "passthrough url literals survive: about:srcdoc",
|
|
"allow": {
|
|
"text": [],
|
|
"url": []
|
|
},
|
|
"input": "about:srcdoc",
|
|
"expected": "about:srcdoc"
|
|
},
|
|
{
|
|
"name": "userinfo is stripped from the authority",
|
|
"allow": {
|
|
"text": [],
|
|
"url": []
|
|
},
|
|
"input": "https://user:[email protected]/settings",
|
|
"expected": "https://app.example.com/[redacted]"
|
|
},
|
|
{
|
|
"name": "scheme without slashes keeps the protocol and redacts the rest: tel",
|
|
"allow": {
|
|
"text": [],
|
|
"url": []
|
|
},
|
|
"input": "tel:+15551234567",
|
|
"expected": "tel:[redacted]"
|
|
},
|
|
{
|
|
"name": "scheme without slashes keeps the protocol and redacts the rest: mailto",
|
|
"allow": {
|
|
"text": [],
|
|
"url": []
|
|
},
|
|
"input": "mailto:[email protected]?subject=hello%20there",
|
|
"expected": "mailto:[redacted]"
|
|
},
|
|
{
|
|
"name": "unknown token before a colon is not treated as a scheme",
|
|
"allow": {
|
|
"text": [],
|
|
"url": []
|
|
},
|
|
"input": "john.fakename:secret-chat",
|
|
"expected": "[redacted]"
|
|
},
|
|
{
|
|
"name": "app deep-link scheme survives with its value scrubbed",
|
|
"allow": {
|
|
"text": [],
|
|
"url": []
|
|
},
|
|
"input": "spotify:track:4uLU6hMCjMI75M1A2tKUQC",
|
|
"expected": "spotify:[redacted]"
|
|
},
|
|
{
|
|
"name": "unencoded ? in userinfo cannot smuggle credentials as a host",
|
|
"allow": {
|
|
"text": [],
|
|
"url": []
|
|
},
|
|
"input": "https://user:[email protected]/path",
|
|
"expected": "https://[redacted]"
|
|
},
|
|
{
|
|
"name": "free text before an embedded :// is not kept as a scheme",
|
|
"allow": {
|
|
"text": [],
|
|
"url": []
|
|
},
|
|
"input": "javascript:mail(\"[email protected]\",\"https://tracker.test/1\")",
|
|
"expected": "javascript:[redacted]//[redacted]/[redacted]"
|
|
}
|
|
]
|