$ show cedricbonhomme/newspipe
Newspipe is a self-hosted web news aggregator (RSS/Atom feed reader) built with Flask. It provides a full-featured reading experience with multi-user support, two-factor authentication, role-based access control, and a RESTful API. The system fetches feeds asynchronously using asyncio, sanitizes content against XSS, and guards against SSRF via IP pinning. It supports categories, bookmarks, tags, notes, search, infinite scroll, and a resizable reading pane. Data can be imported/exported in OPML and JSON formats, and it integrates with Pinboard for bookmark import. The frontend uses Bootstrap 5, Chart.js, and Luxon for relative dates, with i18n support for English, French, and German. The architecture follows a layered pattern: Flask blueprints for views, controllers for data access (with a generic AbstractController), SQLAlchemy models, and utility libraries for security and data handling. The crawler is a separate async module that can be invoked via CLI or cron. The codebase demonstrates strong security practices (CSP, CSRF, safe redirects, input sanitization) and includes unit tests for security-critical components. While the project is well-structured and actively maintained, there is a known bug where non-admin users with API access cause a 500 error on article updates due to a tag association proxy issue.
The LLM identified 4 files worth highlighting for reuse:
Provides a reusable AbstractController base class that implements generic CRUD operations with automatic user scoping, filter parsing (supporting operators like __gt, __like), and pagination. All domain controllers (Article, Feed, Category, etc.) inherit from this, making it a clean, isolated pattern that could be extracted into a Flask extension or used in other projects with minimal modification.
Implements SSRF (Server-Side Request Forgery) protection by resolving hostnames to IP addresses, validating against private/reserved IP ranges, and pinning the resolved IP for the actual HTTP request. Includes a custom HTTP adapter (PinnedIPAdapter) that connects to the validated IP while preserving the original Host header. This is a self-contained, security-critical component that can be reused in any Python application making outbound HTTP requests.
Provides sanitize_html_fragment and sanitize_text functions that strip dangerous HTML tags and attributes using a curated allowlist. It handles edge cases like malformed HTML, script tags, event handlers, and data URIs. The component is isolated and can be reused in any Python project that needs to safely render user-supplied HTML content.
Implements TOTP (Time-based One-Time Password) two-factor authentication with encrypted secret storage, recovery code generation, and QR code provisioning. Uses pyotp for TOTP and cryptography for encrypting secrets at rest. This is a self-contained module that can be extracted and integrated into any Flask or Python application requiring 2FA support.