Security Audit Mitigations & Hardening

.github/workflows/linters.yml

@@ -4,14 +4,15 @@ jobs:
   run-black:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v1
-      - name: Set up Python 3.9.23
-        uses: actions/setup-python@v1
+      - uses: actions/checkout@v4
+      - name: Set up Python 3.10
+        uses: actions/setup-python@v5
         with:
-          python-version: 3.9.23
+          python-version: '3.10'
       - name: Debug Message - Check Github branch
         run: echo "Current Git branch is ${GITHUB_REF##*/}" 
       - name: Install Black
-        run: pip install black==23.1.0
+        run: pip install black==24.3.0
       - name: Run black . to format code.
         run: black .
+

backend/anudesh_backend/settings.py

@@ -12,18 +12,20 @@
 
 import logging
 import os
+import socket
 from datetime import timedelta
 from pathlib import Path
 from dotenv import load_dotenv
 
-load_dotenv()
-
 if os.getenv("GOOGLE_APPLICATION_CREDENTIALS"):
     from google.cloud import logging as gc_logging
 
 # Build paths inside the project like this: BASE_DIR / 'subdir'.
 BASE_DIR = Path(__file__).resolve().parent.parent
 
+# Load environment variables from .env file
+load_dotenv(os.path.join(BASE_DIR, ".env"))
+
 
 # Quick-start development settings - unsuitable for production
 # See https://docs.djangoproject.com/en/4.0/howto/deployment/checklist/
@@ -32,7 +34,11 @@
 SECRET_KEY = os.getenv("SECRET_KEY")
 
 # SECURITY WARNING: don't run with debug turned on in production!
-DEBUG = os.getenv("ENV") == "dev"
+DEBUG = os.getenv("ENV") == "dev" or os.getenv("DEBUG", "False").lower() in (
+    "true",
+    "1",
+    "t",
+)
 
 if DEBUG:
     ALLOWED_HOSTS = ["127.0.0.1", "localhost", "0.0.0.0", "*"]
@@ -41,8 +47,16 @@
         "dev.anudesh.ai4bharat.org",
         "0.0.0.0",
         "backend.dev.anudesh.ai4bharat.org",
+        "backend.anudesh.ai4bharat.org",
     ]
 
+CSRF_TRUSTED_ORIGINS = [
+    "https://backend.anudesh.ai4bharat.org",
+    "https://anudesh.ai4bharat.org",
+    "https://backend.dev.anudesh.ai4bharat.org",
+    "https://dev.anudesh.ai4bharat.org",
+]
+
 # Application definition
 
 INSTALLED_APPS = [
@@ -74,7 +88,7 @@
 
 CSRF_COOKIE_SECURE = False
 
-CSRF_TRUSTED_ORIGINS=['https://*.anudesh.ai4bharat.org']
+CSRF_TRUSTED_ORIGINS = ["https://*.anudesh.ai4bharat.org"]
 
 MIDDLEWARE = [
     "corsheaders.middleware.CorsMiddleware",
@@ -88,7 +102,13 @@
     "whitenoise.middleware.WhiteNoiseMiddleware",
 ]
 
-CORS_ORIGIN_ALLOW_ALL = True
+CORS_ALLOWED_ORIGINS = [
+    "https://anudesh.ai4bharat.org",
+    "https://dev.anudesh.ai4bharat.org",
+    "http://localhost:3000",
+    "http://127.0.0.1:3000",
+]
+
 
 CORS_ALLOW_CREDENTIALS = True
 
@@ -185,6 +205,10 @@
         "rest_framework.authentication.SessionAuthentication",
     ),
     "DEFAULT_PAGINATION_CLASS": "anudesh_backend.pagination.CustomPagination",
+    "DEFAULT_THROTTLE_RATES": {
+        "anon": "10/minute",
+        "user": "60/minute",
+    },
 }
 
 
@@ -298,7 +322,12 @@
 
 # Celery settings
 CELERY_TIMEZONE = "Asia/Kolkata"
-CELERY_BROKER_URL = "redis://redis:6379/0"
+try:
+    socket.gethostbyname("redis")
+    CELERY_BROKER_URL = "redis://redis:6379/0"
+except socket.gaierror:
+    CELERY_BROKER_URL = "redis://localhost:6379/0"
+
 CELERY_BEAT_SCHEDULER = "django_celery_beat.schedulers:DatabaseScheduler"
 
 

backend/dataset/admin.py

@@ -1,4 +1,8 @@
-import resource
+try:
+    import resource
+except ImportError:
+    resource = None
+
 from django.contrib import admin
 from import_export.admin import ImportExportActionModelAdmin
 from .resources import *

backend/deploy/requirements-mac.txt

@@ -22,15 +22,15 @@ botocore==1.40.11
 cachetools==5.5.2
 celery==5.3.4
 certifi==2025.8.3
-cffi==1.17.1
+cffi==2.0.0
 charset-normalizer==3.4.3
 click==8.2.1
 click-didyoumean==0.3.1
 click-plugins==1.1.1.2
 click-repl==0.3.0
 colorama==0.4.6
 cron-descriptor==1.4.5
-cryptography==45.0.6
+cryptography==46.0.7
 datamodel-code-generator==0.26.1
 defusedxml==0.8.0rc2
 diff-match-patch==20241021
@@ -193,7 +193,7 @@ sacrebleu==2.3.1
 schedule==1.2.0
 semver==2.13.0
 sentry-sdk==2.35.0
-setuptools==80.9.0
+setuptools<81
 simplejson==3.19.1
 six==1.16.0
 smart_open==7.3.0.post1