Merge pull request #148 from reconurge/fix/phase1-critical

fix: security issues

.env.example

@@ -6,5 +6,7 @@ NEO4J_URI_BOLT=bolt://neo4j:7687
 NEO4J_USERNAME=neo4j
 NEO4J_PASSWORD=password
 VITE_API_URL=http://127.0.0.1:5001
+# Comma-separated CORS allowed origins. Defaults to http://localhost:5173 (Vite dev) when unset.
+ALLOWED_ORIGINS=http://localhost:5173
 DATABASE_URL=postgresql://flowsint:flowsint@localhost:5433/flowsint
 REDIS_URL=redis://redis:6379/0

flowsint-api/Dockerfile

@@ -110,7 +110,7 @@ WORKDIR /app/flowsint-api
 RUN chmod +x entrypoint.sh
 
 # Switch to non-root user
-# USER flowsint
+USER flowsint
 
 EXPOSE 5001
 

flowsint-api/app/api/deps.py

@@ -2,19 +2,11 @@ from fastapi import Depends, HTTPException, status, Request
 from fastapi.security import OAuth2PasswordBearer
 from jose import JWTError, jwt
 from sqlalchemy.orm import Session
-from flowsint_core.core.auth import ALGORITHM
+from flowsint_core.core.auth import ALGORITHM, AUTH_SECRET
 from flowsint_core.core.postgre_db import get_db
 from flowsint_core.core.models import Profile
 from typing import Optional
 
-import os
-from dotenv import load_dotenv
-
-# Remplace avec ton URL de BDD
-AUTH_SECRET = os.getenv("AUTH_SECRET")
-
-load_dotenv()
-
 oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")
 
 

flowsint-api/app/api/schemas/scan.py

@@ -8,7 +8,7 @@ class ScanCreate(BaseModel):
     values: Optional[List[str]] = None
     sketch_id: Optional[UUID4] = None
     status: Optional[str] = None
-    results: Optional[Any] = None
+    details: Optional[Any] = None
 
 
 class ScanRead(ORMBase):

flowsint-api/app/main.py

@@ -1,3 +1,5 @@
+import os
+
 from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 
@@ -16,8 +18,12 @@ from app.api.routes import types
 from app.api.routes import custom_types
 from app.api.routes import enricher_templates
 
+# Comma-separated list of allowed origins, e.g. "https://app.example.com,https://staging.example.com"
+# Falls back to localhost dev origin when unset. Never use "*" with allow_credentials=True.
 origins = [
-    "*",
+    o.strip()
+    for o in os.getenv("ALLOWED_ORIGINS", "http://localhost:5173").split(",")
+    if o.strip()
 ]
 
 

flowsint-core/src/flowsint_core/tasks/enricher.py

@@ -69,10 +69,10 @@ def run_enricher(
         results = asyncio.run(enricher.execute(values=serialized_objects))
 
         scan.status = EventLevel.COMPLETED
-        scan.results = to_json_serializable(results)
+        scan.details = to_json_serializable(results)
         session.commit()
 
-        return {"result": scan.results}
+        return {"result": scan.details}
 
     except Exception as ex:
         session.rollback()
@@ -82,7 +82,7 @@ def run_enricher(
         scan = session.query(Scan).filter(Scan.id == uuid.UUID(self.request.id)).first()
         if scan:
             scan.status = EventLevel.FAILED
-            scan.results = {"error": error_logs}
+            scan.error = error_logs
             session.commit()
 
         self.update_state(state=states.FAILURE)
@@ -145,10 +145,10 @@ def run_template_enricher(
         results = asyncio.run(enricher.execute(values=serialized_objects))
 
         scan.status = EventLevel.COMPLETED
-        scan.results = to_json_serializable(results)
+        scan.details = to_json_serializable(results)
         session.commit()
 
-        return {"result": scan.results}
+        return {"result": scan.details}
 
     except Exception as ex:
         session.rollback()
@@ -162,7 +162,7 @@ def run_template_enricher(
         )
         if scan:
             scan.status = EventLevel.FAILED
-            scan.results = {"error": error_logs}
+            scan.error = error_logs
             session.commit()
 
         self.update_state(state=states.FAILURE)

flowsint-core/src/flowsint_core/tasks/flow.py

@@ -65,10 +65,10 @@ def run_flow(
         results = enricher.scan(values=serialized_objects)
 
         scan.status = EventLevel.COMPLETED
-        scan.results = to_json_serializable(results)
+        scan.details = to_json_serializable(results)
         session.commit()
 
-        return {"result": scan.results}
+        return {"result": scan.details}
 
     except Exception as ex:
         session.rollback()
@@ -78,7 +78,7 @@ def run_flow(
         scan = session.query(Scan).filter(Scan.id == uuid.UUID(self.request.id)).first()
         if scan:
             scan.status = EventLevel.FAILED
-            scan.results = {"error": error_logs}
+            scan.error = error_logs
             session.commit()
 
         self.update_state(state=states.FAILURE)

flowsint-types/src/flowsint_types/flowsint_base.py

@@ -1,6 +1,6 @@
 from typing import Optional
 
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, ConfigDict, Field
 
 
 class FlowsintType(BaseModel):
@@ -24,6 +24,5 @@ class FlowsintType(BaseModel):
         title="Label",
     )
 
-    # Allow extra keys to support for additional properties from user
-    class ConfigDict:
-        extra = "allow"
+    # Allow extra keys to support additional properties from the user
+    model_config = ConfigDict(extra="allow")