Security features

async def process_entry(
    url: str,
    log_callback: Callable[[str], None],
    check_cancel: Callable[[], bool],
    progress_callback: Optional[Callable[[int, int], None]] = None
) -> None:
    try:
        parsed_url = urlparse(url)
        hostname = parsed_url.netloc.lower()
    except Exception:
        log_callback("[ERROR] Invalid URL provided.")
        return

    for handler in HANDLERS:
        # [SECURITY] SSRF Prevention
        # Validate that the domain exists in the hostname,
        # not just anywhere in the URL string.
        # This prevents attackers from injecting internal URLs like:
        # http://localhost:8000/api/admin?fake=tmohentai
        supported = handler.get_supported_domains()
        if any(domain in hostname for domain in supported):
            await handler.process(url, log_callback, check_cancel, progress_callback)
            return
            
    log_callback("[ERROR] Unsupported website.")

@app.get("/pdfs/{filename:path}")
async def get_pdf(filename: str):
    filename = unquote(filename)
    
    # [SECURITY] Path Traversal / Local File Inclusion (LFI) Prevention
    # This block ensures an attacker cannot inject sequences like '../../'
    # to read system files (e.g., passwords, source code).
    # We force the OS to resolve the absolute real path and verify
    # mathematically that it MUST originate from the 'pdf_dir' folder.
    target_path = os.path.abspath(os.path.join(pdf_dir, filename))
    if not target_path.startswith(os.path.abspath(pdf_dir)):
        print(f"SECURITY WARNING: Attempted path traversal for '{filename}'. Blocked.")
        return {"error": "Invalid file path requested."}
    
    if os.path.exists(target_path) and os.path.isfile(target_path):
        response = FileResponse(target_path, media_type="application/pdf")
        response.headers["Content-Disposition"] = "inline"
        return response
    
    return {"error": "File not found."}

# [SECURITY] CORS Mitigation
# Avoid using allow_origins=["*"] with allow_credentials=True,
# as this would allow any external malicious web page to connect
# to the user's local server.
app.add_middleware(
    CORSMiddleware,
    allow_origins=[
        "http://localhost:3000",
        "http://localhost:5173",
        "http://127.0.0.1:3000",
        "http://127.0.0.1:5173"
    ],
    allow_credentials=True,
    allow_methods=["GET", "POST", "OPTIONS"],
    allow_headers=["*"],
)

# Basic DoS Protection: Limit active downloads
ACTIVE_DOWNLOADS = 0
MAX_DOWNLOADS = 3

@app.websocket("/ws")
async def websocket_endpoint(websocket: WebSocket):
    global ACTIVE_DOWNLOADS
    await websocket.accept()
    
    # ... (cancel event setup)
    
    if command == "start":
        # SECURITY PATCH: DoS / Resource Exhaustion Protection
        if ACTIVE_DOWNLOADS >= MAX_DOWNLOADS:
            await websocket.send_json({
                "type": "error",
                "message": "Server is currently busy. Please try again later."
            })
            continue
        
        ACTIVE_DOWNLOADS += 1
        # ... (process download)
        
        finally:
            ACTIVE_DOWNLOADS = max(0, ACTIVE_DOWNLOADS - 1)

try:
    await core.process_entry(
        url, 
        log_callback, 
        check_cancel, 
        progress_callback=progress_callback
    )
    await websocket.send_json({
        "type": "status", 
        "status": "completed",
        "filename": final_filename
    })
except Exception as e:
    # SECURITY PATCH: Information Leakage Prevention
    # Log the actual error to the console, send a sanitized message to the client
    logging.error(f"Internal processing error: {e}")
    await websocket.send_json({
        "type": "error",
        "message": "An unexpected internal error occurred during processing."
    })
    await websocket.send_json({"type": "status", "status": "error"})