mirror of https://github.com/home-assistant/supervisor.git synced 2026-09-30 07:18:44 +01:00

T

Stefan AgnerandClaude Fable 5.1 94b4a0b77c Forward Core API proxy paths byte-for-byte and match deny rules on decoded path (#7225 )

The Core API proxy compared its deny pattern against the once-decoded route
capture and then formatted that string into the upstream URL, where yarl
decoded percent-encoded unreserved characters a second time. A path such as
hassio%255Fauth/password_reset passed both the middleware blacklist and the
proxy's deny check but reached Core as /api/hassio_auth/password_reset,
which the proxy executes as the Supervisor user.

Forward the raw path exactly as received instead of the decoded capture, and
build the upstream URL with encoded=True so the bytes checked are the bytes
sent. This also stops lossy re-encoding of legitimate paths, e.g. an encoded
slash no longer turns into a path separator. Match both the middleware
blacklist and the proxy deny pattern against the recursively unquoted path
so any encoding depth resolves to the same decision. The recursive unquote
helper moves to module level so both call sites share it.

Reported in GHSA-m2gm-724m-7rf9.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

2026-09-15 13:11:08 +02:00

.devcontainer

Bump devcontainer to 6 (#6747 )

2026-04-21 16:52:28 +02:00

.github

Bump home-assistant/builder/actions/prepare-multi-arch-matrix from 2026.06.0 to 2026.09.0 (#7224 )

2026-09-15 08:48:04 +02:00

.vscode

Migrate to Ruff for lint and format (#4852 )

2024-02-05 11:37:39 -05:00

rootfs/etc

Replace preloaded jemalloc with PYTHONMALLOC=mimalloc (#7056 )

2026-07-18 18:50:14 +02:00

script

Add mypy to ci and precommit (#5969 )

2025-06-24 11:48:03 +02:00

supervisor

Forward Core API proxy paths byte-for-byte and match deny rules on decoded path (#7225 )

2026-09-15 13:11:08 +02:00

tests

Forward Core API proxy paths byte-for-byte and match deny rules on decoded path (#7225 )

2026-09-15 13:11:08 +02:00

wheels

Use unpublished local wheels during PR builds (#6374 )

2025-12-02 14:08:07 +01:00

.dockerignore

Use unpublished local wheels during PR builds (#6374 )

2025-12-02 14:08:07 +01:00

.gitignore

Use unpublished local wheels during PR builds (#6374 )

2025-12-02 14:08:07 +01:00

.hadolint.yaml

Revert "Revert "Update base images to 3.11-alpine3.18 (#4639 )" (#4646 )" (#4657 )

2023-11-02 11:29:15 +01:00

.pre-commit-config.yaml

Run the mypy pre-commit hook the same way as CI (#6977 )

2026-06-25 17:27:46 +02:00

.vcnignore

…

AGENTS.md

Add AGENTS.md symlink (#6237 )

2025-10-08 10:44:49 +02:00

AI_POLICY.md

Add the Open Home Foundation AI Policy (#7066 )

2026-07-21 11:57:21 +02:00

CLAUDE.md

Add GitHub Copilot/Claude instruction (#5986 )

2025-07-04 07:05:05 +02:00

codecov.yaml

Improve codecov settings for more sensible defaults (#6676 )

2026-03-30 13:24:22 +02:00

Dockerfile

Update Python to 3.14.6/base image to 3.14-alpine3.24-2026.06.1 (#7045 )

2026-07-17 13:31:41 +02:00

LICENSE

…

MANIFEST.in

…

pyproject.toml

Bump setuptools from 83.0.0 to 84.0.0 (#7124 )

2026-08-13 16:32:46 -04:00

README.md

Add OHF logo to README (#5316 )

2024-09-30 18:42:08 +02:00

requirements_tests.txt

Bump ruff from 0.16.6 to 0.16.7 (#7216 )

2026-09-14 10:34:09 +02:00

requirements.txt

Bump sentry-sdk from 2.68.1 to 2.69.1 (#7215 )

2026-09-14 10:34:53 +02:00

setup.py

Fix version/requirements parsing in setup.py, set version in Dockerfile (#6692 )

2026-04-01 16:01:46 +02:00

tox.ini

Default pytest --timeout=10 in pyproject.toml (#6797 )

2026-05-04 14:48:36 +02:00

README.md

Home Assistant Supervisor

First private cloud solution for home automation

Home Assistant (former Hass.io) is a container-based system for managing your Home Assistant Core installation and related applications. The system is controlled via Home Assistant which communicates with the Supervisor. The Supervisor provides an API to manage the installation. This includes changing network settings or installing and updating software.

Installation

Installation instructions can be found at https://home-assistant.io/getting-started.

Development

For small changes and bugfixes you can just follow this, but for significant changes open a RFC first. Development instructions can be found here.

Release

Releases are done in 3 stages (channels) with this structure:

Pull requests are merged to the main branch.
A new build is pushed to the dev stage.
Releases are published.
A new build is pushed to the beta stage.
The stable.json file is updated.
The build that was pushed to beta will now be pushed to stable.