MakazhanAlpamys/Soup v0.24.3

v0.24.3 — Security Hardening

on GitHub

What's New

Patch release with security hardening fixes from code review of v0.24.2.

Security Fixes

• SSRF hardening: Chat proxy now uses ipaddress.is_loopback instead of string allowlist — blocks 192.168.x.x, 10.x.x.x, ::ffff:127.0.0.1 while correctly allowing 127.x.x.x range
• XSS prevention: All server-supplied values (run IDs, model names, error messages, PIDs, eval results) escaped via escapeHtml() before innerHTML injection
• Input validation: Last-Event-ID header validated with isdigit() before int() parse (prevents ValueError 500)
• Type safety: ChatRequest.messages typed as list[ChatMessage] with role+content Pydantic model (prevents arbitrary payload forwarding)
• Race condition: _train_process global reads now protected with _train_lock
• Error handling: form_to_yaml exception narrowed to ValueError/TypeError (no raw traceback leak)
• Schema fix: Optional[Literal[...]] detection filters NoneType from args

Tests

• 2 new SSRF tests (reject private IP, allow 127.0.0.2 loopback)
• 2130 total tests, 78 files, 67% coverage

Install / Upgrade

pip install --upgrade soup-cli