Alpamys
|
b90f6e0c7a
|
fix(security): harden chat proxy SSRF with ipaddress.is_loopback validation
Replace string-based hostname allowlist with ipaddress.ip_address().is_loopback
to properly handle 127.x.x.x range and IPv6 loopback. Blocks private/link-local
addresses (192.168.x.x, 10.x.x.x, ::ffff:127.0.0.1) for HTTP endpoints.
Adds 2 tests: reject private IP, allow 127.0.0.2 loopback.
|
2026-04-07 19:28:08 +05:00 |
|
Alpamys
|
54230f7bdd
|
feat(ui): add Web UI Enhancement with live training monitor, enhanced metrics, chat upgrade, and config builder (v0.24.2)
Part A: Training Live Monitor — SSE log streaming (/api/train/logs with
Last-Event-ID reconnection), live metrics SSE (/api/train/metrics/live),
progress endpoint (/api/train/progress), frontend with auto-scroll log
panel, progress bar, and live indicator badge.
Part B: Enhanced Metrics & Eval Display — 2x2 chart grid (loss, LR,
grad_norm, throughput) + GPU memory chart, eval results table in run
detail modal, /api/runs/compare endpoint (max 5 runs).
Part C: Chat Upgrade — /api/chat/send SSE proxy with SSRF protection
(localhost-only HTTP, HTTPS for remote), streaming via ReadableStream,
typing indicator, cancel button, markdown renderer (bold/italic/code),
chat settings panel (temperature/max_tokens/top_p/system prompt/adapter),
chat export as JSON.
Part D: Visual Config Builder — /api/config/schema (Pydantic field
metadata extraction), /api/recipes (29 ready-made configs as JSON),
/api/config/from-form (form values to validated YAML), recipe dropdown.
Security: Chat proxy SSRF validation, max_tokens cap 16384, temperature
0-2, top_p 0-1, Bearer auth on POST, XSS prevention, compare max 5 runs.
Tests: 58 new tests across 4 files (2128 total, 78 files), 67% coverage.
|
2026-04-07 19:13:55 +05:00 |