Spaces:
Sleeping
Sleeping
Commit History
-
Sync detection engine from RodSizer: watershed splitting + OCR calibration
Bring the public web backend up to date with the local app's improvements, keeping the session-scoped storage model unchanged: - processing.py / autodetect_utils.py / utils.py copied wholesale (they are session-agnostic — they operate on the dirs main.py passes in). This adds: distance-transform watershed clump splitting (replaces rUECS as the primary separator; dense clumps no longer collapse into one blob), bounding-box measurement with find_objects + localized NMS (faster), and OCR scale-bar / footer auto-calibration for camera exports with no embedded metadata. - requirements.txt: add pytesseract (OCR); drop the unused tensorflow + stardist (huge dead deps — major HF build-time / image-size win) and matplotlib (no longer imported). - main.py: RESULTS_SCHEMA_VERSION 2 -> 6 so old cached results regenerate with the new engine; serve the frontend HTML with no-cache headers. main.py's /process and /process/{id}/binary_preview already passed binary_mask_tune and called …4caef13
-
Fix image_id validator: accept <uuid>_<name> upload format
Uploads are stored with stems of the form "<uuid>_<sanitized_filename>", but _validate_image_id only accepted bare UUIDs, so every /process/{id} call 400'd with "Invalid image id". Relaxes _IMAGE_ID_RE to accept an optional "_<rest>" suffix while still rejecting control chars, path separators, and glob metacharacters. Also replaces rglob(f"{image_id}.*") / glob(f"{image_id}*") with explicit stem/name comparison so image_id can never be interpreted as a glob pattern even if validation is bypassed.e96a12f -
Harden session/path/ID validation and fix XSS for public-facing web version
Session IDs, image IDs, folder names, and result filenames flow directly into filesystem paths in /tmp/uploads/<session>/ and /tmp/results/<session>/. Because this build runs on public Hugging Face Spaces, an attacker could previously use ../ in session_id or filename to read/write other sessions or arbitrary container paths. - Enforce a strict format for session_id (8–128 chars, [A-Za-z0-9_-]) and reject traversal tokens; resolve per-session dirs under the root. - Validate image_id as UUID4 before any rglob() to block glob-metacharacter injection. - Sanitize folder names (reject "." / ".." / separators) and _safe_join them under the session upload dir. - Rewrite /results/{filename} to forbid traversal, glob metacharacters, and control chars, and verify the resolved path stays inside the session dir. - Rebuild gallery cards and table rows with DOM APIs so user-supplied filenames and IDs cannot inject HTML or inline-event handlers. - Cap upload size (200 MB per file) and file…6e77125
-
Auto-cleanup session dirs older than 24h to prevent storage overflow
27af115 -
Add per-session file isolation for multi-user support
de3e784 -
Initial commit
065e391