Releases: ail-project/lacus
Release list
v1.25.0
- Validate UUIDs before processing and in URLs
- Maintenance release, bump deps.
Full Changelog: v1.24.3...v1.25.0
v1.24.3
v1.24.2
- Add warning on update if running on Ubuntu 26.04
- Bump pure-magic-rs to avoid panic on some files
- Bump playwright
- Update sample files for reverse proxy (nginx/apache)
Full Changelog: v1.24.1...v1.24.2
v1.24.1
Bugfixes
- Exception when headfull remote interactive module (Tactus) is disabled and couldn't start
- Allow HTTP headers in the settings to be submitted as a json dump
Full Changelog: v1.24.0...v1.24.1
v1.24.0
Important security release
PlaywrightCapture did not sufficiently restrict navigation and resource requests initiated by rendered pages. Find more details in the advisory: GHSA-687h-xw6f-q2qw
Please update any Lacus instance used to render untrusted pages (that's all of them 🙃).
POC
The call below was rendering /etc/passwd from the machine Lacus is running on. That applies to any file the user running lacus can read.
curl -s -X POST "http://<domain>/enqueue" -H "Content-Type: application/json" -d '{
"document": "'$(echo '<html><body><script>window.location.href="file:///etc/passwd";</script></body></html>' | base64 -w0)'",
"document_name": "test.html"
}'The fix also blocks calls to non-global IPs that could be triggered by the rendered page.
Thank you very much to @jeroengui for the report and PoC.
New features
- Add support for remote interactive headfull captures using xpra-html5. To use it, you need to install xpra (see readme).
This feature should be considered beta at this stage and the API is subject to changes.
Screencast_20260430_163512.webm
- Expose instance settings so a user knows what can be captured (tor, i2p) and how (headed, remote headed) and if the trusted timestamps are automatically generated.
Changes
- Many improvement sin the logging system
- Use latest playwright
What's Changed
- feat: interactive capture sessions with Tactus sidecar by @DocArmoryTech in #68
New Contributors
- @DocArmoryTech made their first contribution in #68
Full Changelog: v1.23.0...v1.24.0
Contributors
Assets 2
v1.23.0
New Features
- Use Pydantic models to normalize and validate capture settings. Use the same models everywhere (Lacus, Lookyloo, Monitoring, APIs) to avoid duplicating code and weird inconsistencies.
Changes
- [PlaywrightCapture] Improve handling of base64 blobs
- [PlaywrightCapture] Scroll more and more randomly once the page is rendered
- [PlaywrightCapture] De-duplicate downloaded files
- [PlaywrightCapture] Use pure-magic-rs
- [PlaywrightCapture] Improve ending capture if page stuck
- [LacusCore] Accept more settings for the cookies
What's Changed
- build(deps): bump actions/checkout from 4 to 6 by @dependabot[bot] in #58
- build(deps): bump actions/setup-python from 5 to 6 by @dependabot[bot] in #57
Full Changelog: v1.22.0...v1.23.0
Contributors
Assets 2
v1.22.0
New Feature
final_wait: After the instrumentation is done, the browser will wait for some time (in seconds) before it finishes. It is useful when a page runs JS code on a timer without any network interactions and you want to wait until that timer triggers
Changes
- Better exception handling, improve logging
- Bump Playwright, avoid screenshots to get stuck waiting for the fonts to load
Full Changelog: v1.21.2...v1.22.0
v1.21.2
Expose devices supported by Playwright: GET request on /playwright_devices.
Full Changelog: v1.21.1...v1.21.2
v1.21.1
Maintenance release to bump aiohttp, urllib3 and werkzeug due to reported vulnerabilities.
Full Changelog: v1.21.0...v1.21.1
v1.21.0
This is mostly a maintenance release, but it adds the following:
- Playwright v1.57.0, with a new version of the browsers
- A script using protonvpn-wg-config-generate to auto-create and update the VPN configs.
Full Changelog: v1.20.0...v1.21.0