Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions application/single_app/config.py
Original file line number Diff line number Diff line change
Expand Up @@ -101,7 +101,7 @@
EXECUTOR_TYPE = 'thread'
EXECUTOR_MAX_WORKERS = 30
SESSION_TYPE = 'filesystem'
VERSION = "0.261.322"
VERSION = "0.261.323"
IS_DEVELOPMENT = is_development_env_enabled()

# Opt-out for deployments where App Service Easy Auth is active but the platform
Expand Down Expand Up @@ -195,7 +195,7 @@ def _split_env_list(raw_value, lowercase=False):

# Base allowed extensions (always available)
BASE_ALLOWED_EXTENSIONS = {'txt', 'doc', 'docm', 'html', 'md', 'json', 'xml', 'yaml', 'yml', 'log'}
DOCUMENT_EXTENSIONS = {'pdf', 'docx', 'pptx', 'ppt'}
DOCUMENT_EXTENSIONS = {'pdf', 'docx', 'dotx', 'pptx', 'potx', 'ppt'}
TABULAR_EXTENSIONS = {'csv', 'xlsx', 'xls', 'xlsm'}
SCHEMA_EXTENSIONS = {'xsd'}
VISIO_EXTENSIONS = {'vsdx'}
Expand Down
13 changes: 11 additions & 2 deletions application/single_app/content_screening/publication.py
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
)
from content_screening.exports import build_clean_artifact, structured_sheets, table_schema_text
from content_screening.extraction import heartbeat_publication, is_publication, publication_chunks
from functions_document_transform_sources import OFFICE_REFERENCE_MIME_TYPES, TEMPLATE_EXTENSIONS, native_template_pages

Check warning on line 24 in application/single_app/content_screening/publication.py

View workflow job for this annotation

GitHub Actions / malicious-pr-security-review

Important - Changed line contains dynamic execution, persistence, or system access marker. Recommendation%3A Do not execute changed lifecycle scripts or installers while this finding is unresolved.


def _document_helpers():
Expand Down Expand Up @@ -185,7 +186,8 @@
else:
file_name = document.get("file_name") or scan["original_file_name"]
content = storage.read_bytes(scan["source_ref"], subject)
content_type = mimetypes.guess_type(file_name)[0] or "application/octet-stream"
extension = "." + file_name.rsplit(".", 1)[-1].lower()
content_type = OFFICE_REFERENCE_MIME_TYPES.get(extension) or mimetypes.guess_type(file_name)[0] or "application/octet-stream"

Check warning on line 190 in application/single_app/content_screening/publication.py

View workflow job for this annotation

GitHub Actions / malicious-pr-security-review

Important - Changed line contains dynamic execution, persistence, or system access marker. Recommendation%3A Do not execute changed lifecycle scripts or installers while this finding is unresolved.
metadata = _metadata_from_units(units, file_name)
settings = helpers.get_settings()
max_characters = min(
Expand All @@ -199,7 +201,14 @@
else:
chunks = publication_chunks(units, max_characters)
if not chunks:
raise ScreeningValidationError("No reviewed content is available to publish.")
extension = "." + file_name.rsplit(".", 1)[-1].lower()
if extension not in TEMPLATE_EXTENSIONS or scan.get("sanitized") or not scan.get("source_ref"):
raise ScreeningValidationError("No reviewed content is available to publish.")
# An empty native template can be released, but only after the normal review and

Check warning on line 207 in application/single_app/content_screening/publication.py

View workflow job for this annotation

GitHub Actions / malicious-pr-security-review

Important - Changed line contains dynamic execution, persistence, or system access marker. Recommendation%3A Do not execute changed lifecycle scripts or installers while this finding is unresolved.
# original-byte binding. Never fabricate a searchable narrative to clear the hold.

Check warning on line 208 in application/single_app/content_screening/publication.py

View workflow job for this annotation

GitHub Actions / malicious-pr-security-review

Important - Changed line contains secret or sensitive data source marker. Recommendation%3A Pair this source with any nearby network, logging, serialization, or process execution sink before approving.
pages, _supplemental, _structure = native_template_pages(content, extension)
if any(page["content"].strip() for page in pages):
raise ScreeningValidationError("Reviewed template content is missing.")
scope_args = {
"group_id": subject.scope_id if subject.scope_type == "group" else None,
"public_workspace_id": subject.scope_id if subject.scope_type == "public" else None,
Expand Down
9 changes: 9 additions & 0 deletions application/single_app/functions_chat_upload_extraction.py
Original file line number Diff line number Diff line change
Expand Up @@ -146,6 +146,15 @@
details = build_workspace_upload_details(document, len(ordered_chunks))
body = indexed_text or render_vision_analysis_text(details["vision_analysis"])

if not body:
source = document if isinstance(document, dict) else {}
native_template_ready = (
str(source.get("file_name") or filename).lower().endswith((".dotx", ".potx"))
and isinstance(source.get("office_template_structure"), dict)

Check warning on line 153 in application/single_app/functions_chat_upload_extraction.py

View workflow job for this annotation

GitHub Actions / malicious-pr-security-review

Important - Changed line contains dynamic execution, persistence, or system access marker. Recommendation%3A Do not execute changed lifecycle scripts or installers while this finding is unresolved.
and not is_workspace_upload_failed(source) and not is_workspace_upload_processing(source)
)
if native_template_ready:
body = "Native Office template retained for structural inspection. No narrative content was indexed."

Check warning on line 157 in application/single_app/functions_chat_upload_extraction.py

View workflow job for this annotation

GitHub Actions / malicious-pr-security-review

Important - Changed line contains dynamic execution, persistence, or system access marker. Recommendation%3A Do not execute changed lifecycle scripts or installers while this finding is unresolved.
if not body:
source = document if isinstance(document, dict) else {}
if is_workspace_upload_failed(source):
Expand Down
Loading
Loading