Replace `assert` with explicit error handling in OAuth callback (a.k.a. document no -O flag usage)

[andrewmusselman]

Source: V10.4.2 audit — Observation 2

Description

In src/asfquart/generics.py (line ~69), the OAuth token exchange uses a Python assert statement to verify the response from the authorization server:

assert rv.status == 200, "Could not verify oauth response."

assert statements are stripped when Python is run with the -O (optimize) flag. If the application were ever started with optimization enabled, this check would be silently skipped, potentially allowing the OAuth flow to proceed with a failed or malicious token exchange response.

Recommendation

1. Document we cannot run with -O flag

Or replace with explicit exception handling:

if rv.status != 200:
    return quart.Response(status=403, response="OAuth authentication failed.")

Severity

Low — requires the unlikely condition of running with -O, but violates defense-in-depth principles for an authentication-critical code path.

[sebbASF]

Rather than document the requirement not to use -O (which can be overlooked), why not check that asserts are not disabled?

e.g.

https://github.com/apache/infrastructure-asfpy/blob/cfa849c5f1491fc29367d5589eccf21cf55ff3ff/asfpy/messaging.py#L33-L34