Skip to content

Repo review: a silent captcha bypass, three doubling generators, and 246 lines that lied #226

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adamjohnwright merged 5 commits into from
Sep 17, 2026
Merged

Repo review: a silent captcha bypass, three doubling generators, and 246 lines that lied #226

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
360e84e
Read the captcha secret from where every other secret comes from
adamjohnwright Sep 17, 2026
853db96
Make the Alliance generator say what it does
adamjohnwright Sep 17, 2026
d55060d
Stop two more generators doubling their collections
adamjohnwright Sep 17, 2026
0a799a5
Give the Alliance generator its bundle directory instead of the CWD
adamjohnwright Sep 17, 2026
217dc2e
Test what the generators do, not what their source looks like
adamjohnwright Sep 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions bin/chat-fastapi.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,12 @@ async def verify_captcha_middleware(
f"{CHAINLIT_URI}/static",
]
or path.startswith("/static")
or not os.getenv("CLOUDFLARE_SECRET_KEY")
# The value resolved through get_secret, not os.environ. get_secret
# prefers a mounted Docker secret file, so a deployment that mounts the
# key rather than exporting it used to land here with the env var unset
# and skip the captcha entirely -- switching off a protection the
# operator had configured, silently.
or not CLOUDFLARE_SECRET_KEY
or (CHAINLIT_URI and not path.startswith(CHAINLIT_URI))
):
return await call_next(request)
Expand Down Expand Up @@ -170,7 +175,10 @@ async def verify_captcha(request: Request) -> Response:
# Verify the CAPTCHA with Cloudflare
url = "https://challenges.cloudflare.com/turnstile/v0/siteverify"
data = {
"secret": os.getenv("CLOUDFLARE_SECRET_KEY"),
# Same reason: os.environ can be empty while the secret is mounted, and
# sending Cloudflare a null secret fails in a way that reads as a captcha
# problem rather than a configuration one.
"secret": CLOUDFLARE_SECRET_KEY,
"response": cf_turnstile_response,
"remoteip": client_ip,
}
Expand Down
Loading
Loading