16 lines
603 B
Markdown
16 lines
603 B
Markdown
# Bug Tracking
|
|
|
|
No open bugs. All known issues have been fixed or accepted.
|
|
|
|
## Wontfix / Design Notes
|
|
|
|
### `_assert_safe_path` TOCTOU race
|
|
`spectra/web/server.py` — Path check and `send_file()` are not atomic. An attacker needs write access to the uploads dir to exploit. Mitigation would add complexity with negligible security gain.
|
|
|
|
### No cascade delete on Rotation FK
|
|
`spectra/web/models.py:31` — `Rotation.image_id` has no `ondelete="CASCADE"`. The single delete route handles cleanup explicitly. Add cascade if new deletion paths are added.
|
|
|
|
---
|
|
|
|
For a full history of fixes, see `git log`.
|