Security: Fix DoS risks, patch XXE vulnerability, and add security he…

backend/api/projects/resources.py

@@ -575,8 +575,8 @@ def setup_search_dto(request) -> ProjectSearchDTO:
         if request.query_params.get("basedOnMyInterests") == "true":
             search_dto.based_on_user_interests = authenticated_user_id
 
-    except Exception:
-        pass
+    except AttributeError as e:
+        logger.warning("Unable to read authenticated user details: {}", e)
 
     mapping_types_str = request.query_params.get("mappingTypes")
     if mapping_types_str:

backend/api/system/general.py

@@ -255,8 +255,9 @@ async def release(db: Database = Depends(get_db)):
         description: Internal server error
     """
     response = requests.get(
-        "https://api.github.com/repos/hotosm/tasking-manager/releases/latest"
-    )
+        "https://api.github.com/repos/hotosm/tasking-manager/releases/latest",
+        timeout=30,
+    ).json()
     try:
         tag_name = response.json()["tag_name"]
         published_date = response.json()["published_at"]

backend/main.py

@@ -40,6 +40,22 @@ async def lifespan(app):
         docs_url="/api/docs",
     )
 
+    @_app.middleware("http")
+    async def add_security_headers(request: Request, call_next):
+        response = await call_next(request)
+        # Prevents MIME-sniffing
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        # Prevents Clickjacking by restricting framing
+        response.headers["X-Frame-Options"] = "SAMEORIGIN"
+        # Basic Content Security Policy
+        response.headers["Content-Security-Policy"] = (
+            "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' "
+            "'unsafe-inline';"
+        )
+        # Obscures the specific server software version
+        response.headers["Server"] = "Tasking-Manager"
+        return response
+
     # Initialize Sentry only if USE_SENTRY is enabled
     if settings.USE_SENTRY:
         sentry_sdk.init(

backend/models/postgis/project.py

@@ -361,7 +361,7 @@ def set_country_info(self):
             "Referer": os.environ.get("TM_APP_BASE_URL", "https://example.com"),
         }
         try:
-            response = requests.get(url, headers=headers)
+            response = requests.get(url, headers=headers, timeout=30)
             response.raise_for_status()
             country_info = response.json()  # returns a dict
             if country_info["address"].get("country") is not None:

backend/services/mapping_service.py

@@ -1,5 +1,5 @@
 import datetime
-import xml.etree.ElementTree as ET
+import defusedxml.ElementTree as ET
 
 from databases import Database
 from fastapi import BackgroundTasks

backend/services/project_search_service.py

@@ -915,7 +915,11 @@ async def get_projects_geojson(
                     project.default_locale,
                 )
             except Exception:
-                pass
+                logger.exception(
+                    "Failed to load localized project info for project_id={}",
+                    project.id,
+                )
+                continue
 
             properties = {
                 "projectId": project.id,

desktop.ini

@@ -0,0 +1,2 @@
+[.ShellClassInfo]
+LocalizedResourceName=@tasking-manager-develop,0

frontend/src/components/header/signUp.js

@@ -88,9 +88,14 @@
   };
 
   const checkFields = () => {
+    if (data.email.length > 254) {
+      setStep({ ...step, errMessage: <FormattedMessage {...messages.invalidEmail} /> });
+      return;
+    }
+
     const re =
       // eslint-disable-next-line no-useless-escape
-      /^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/;
+      /^(?=.{1,254}$)(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/;
     if (re.test(data.email) === false) {
       setStep({ ...step, errMessage: <FormattedMessage {...messages.invalidEmail} /> });
       return;

pyproject.toml

@@ -76,3 +76,6 @@ version_scheme = "pep440"
 version_provider = "pep621"
 update_changelog_on_bump = true
 major_version_zero = true
+
+[tool.bandit]
+exclude_dirs = ["tests"]

requirements.txt

@@ -2,6 +2,7 @@ alembic==1.11.1
 APScheduler==3.10.1
 bleach==6.0.0
 cachetools==5.3.1
+defusedxml
 fastapi==0.108.0
 GeoAlchemy2==0.14.3
 geojson==3.1.0

tests/api/helpers/test_helpers.py

@@ -3,7 +3,7 @@
 import json
 import logging
 import os
-import xml.etree.ElementTree as ET
+import defusedxml.ElementTree as ET
 from typing import Tuple
 
 from backend.exceptions import NotFound

tests/api/integration/api/tasks/test_resources.py

@@ -1,6 +1,6 @@
 # tests/api/integration/test_tasks_queries_refactored.py
 import base64
-import xml.etree.ElementTree as ET
+import defusedxml.ElementTree as ET
 
 import pytest
 from httpx import AsyncClient

tests/api/integration/services/test_mapping_service.py

@@ -1,5 +1,5 @@
 import datetime
-import xml.etree.ElementTree as ET
+import defusedxml.ElementTree as ET
 from unittest.mock import patch
 
 from backend.services.project_service import ProjectService

tests/backend/helpers/test_helpers.py

@@ -1,7 +1,7 @@
 import base64
 import json
 import os
-import xml.etree.ElementTree as ET
+import defusedxml.ElementTree as ET
 from typing import Tuple
 
 import geojson

tests/backend/integration/api/system/test_general.py

@@ -17,7 +17,8 @@ def test_post_banner(self):
         url = "/api/v2/system/release/"
         response = self.client.post(url)
         release = requests.get(
-            "https://api.github.com/repos/hotosm/tasking-manager/releases/latest"
+            "https://api.github.com/repos/hotosm/tasking-manager/releases/latest",
+            timeout=30,
         ).json()
         # Assert
         self.assertEqual(response.status_code, 201)

tests/backend/integration/api/tasks/test_resources.py

@@ -1,4 +1,4 @@
-import xml.etree.ElementTree as ET
+import defusedxml.ElementTree as ET
 
 from backend.models.postgis.statuses import TaskStatus, UserRole
 from backend.models.postgis.task import Task

tests/backend/integration/services/test_mapping_service.py

@@ -1,5 +1,5 @@
 import datetime
-import xml.etree.ElementTree as ET
+import defusedxml.ElementTree as ET
 from unittest.mock import patch
 
 from backend.models.postgis.task import TaskStatus