Release Query Tools 0.2.0

2026-09-02 10:28:20 +02:00
parent 2730ce08b2
commit f44d0598da
34 changed files with 5153 additions and 300 deletions
@@ -1,3 +1,18 @@
 # Security

-Report vulnerabilities privately through the Gitea repository owner. Never attach confidential datasets publicly. Inputs are untrusted, bounded, rendered inertly, and never executed; XML DTD/entities and dangerous JSON keys are rejected.
+Report vulnerabilities privately through the Gitea repository owner. Never
+attach confidential datasets publicly. Inputs are untrusted, bounded, rendered
+inertly, and never evaluated as application code; XML DTD/entities and dangerous
+JSON keys are rejected.
+
+The built-in query languages use fixed parsers and interpreters without `eval`
+or dynamic function construction. DuckDB mode accepts one parsed `SELECT`
+statement, rejects semicolons and mutation, extension, attachment, file and
+configuration keywords, then executes against a bounded in-memory table in a
+disposable locally bundled WASM worker. External access and extension
+installation/loading are disabled; startup/query deadlines terminate the worker
+and stale results cannot replace newer state.
+
+Deployment must serve the bundled WASM with `application/wasm` and a CSP that
+allows same-origin WASM and workers while keeping `connect-src 'self'`. Browser
+release tests verify those headers and fail on third-party requests.