Fix: 4xx and 5xx responses from API Gateway cause Invicti findings (DataBiosphere/azul-private#154) #6385

dsotirho-ucsc · 2024-07-04T00:43:01Z

Connected issues: DataBiosphere/azul-private#154

Checklist

Author

PR is a draft
Target branch is develop
Name of PR branch matches issues/<GitHub handle of author>/<issue#>-<slug>
On ZenHub, PR is connected to all issues it (partially) resolves
PR description links to connected issues
PR title matches¹ that of a connected issue _{or comment in PR explains why they're different}
PR title references all connected issues
For each connected issue, there is at least one commit whose title references that issue

¹ when the issue title describes a problem, the corresponding PR
title is Fix: followed by the issue title

Author (partiality)

Added p tag to titles of partial commits
This PR is labeled partial _{or completely resolves all connected issues}
This PR partially resolves each of the connected issues _{or does not have the partial label}

Author (chains)

This PR is blocked by previous PR in the chain _{or is not chained to another PR}
The blocking PR is labeled base _{or this PR is not chained to another PR}
This PR is labeled chained _{or is not chained to another PR}

Author (reindex, API changes)

Added r tag to commit title _{or the changes introduced by this PR will not require reindexing of any deployment}
This PR is labeled reindex:dev _{or the changes introduced by it will not require reindexing of dev}
This PR is labeled reindex:anvildev _{or the changes introduced by it will not require reindexing of anvildev}
This PR is labeled reindex:anvilprod _{or the changes introduced by it will not require reindexing of anvilprod}
This PR is labeled reindex:prod _{or the changes introduced by it will not require reindexing of prod}
This PR is labeled reindex:partial and its description documents the specific reindexing procedure for dev, anvildev, anvilprod and prod _{or requires a full reindex or carries none of the labels reindex:dev, reindex:anvildev, reindex:anvilprod and reindex:prod}
This PR and its connected issues are labeled API _{or this PR does not modify a REST API}
Added a (A) tag to commit title for backwards (in)compatible changes _{or this PR does not modify a REST API}
Updated REST API version number in app.py _{or this PR does not modify a REST API}

Author (upgrading deployments)

Ran make image_manifests.json and committed the resulting changes _{or this PR does not modify azul_docker_images, or any other variables referenced in the definition of that variable}
Documented upgrading of deployments in UPGRADING.rst _{or this PR does not require upgrading deployments}
Added u tag to commit title _{or this PR does not require upgrading deployments}
This PR is labeled upgrade _{or does not require upgrading deployments}
This PR is labeled deploy:shared _{or does not modify image_manifests.json, and does not require deploying the shared component for any other reason}
This PR is labeled deploy:gitlab _{or does not require deploying the gitlab component}
This PR is labeled deploy:runner _{or does not require deploying the runner image}

Author (hotfixes)

Added F tag to main commit title _{or this PR does not include permanent fix for a temporary hotfix}
Reverted the temporary hotfixes for any connected issues _{or the none of the stable branches (anvilprod and prod) have temporary hotfixes for any of the issues connected to this PR}

Author (before every review)

Rebased PR branch on develop, squashed old fixups
Ran make requirements_update _{or this PR does not modify requirements*.txt, common.mk, Makefile and Dockerfile}
Added R tag to commit title _{or this PR does not modify requirements*.txt}
This PR is labeled reqs _{or does not modify requirements*.txt}
make integration_test passes in personal deployment _{or this PR does not modify functionality that could affect the IT outcome}

Peer reviewer (after approval)

PR is not a draft
Ticket is in Review requested column
PR is awaiting requested review from system administrator
PR is assigned to only the system administrator

System administrator (after approval)

Actually approved the PR
Labeled connected issues as demo or no demo
Commented on connected issues about demo expectations _{or all connected issues are labeled no demo}
Decided if PR can be labeled no sandbox
A comment to this PR details the completed security design review
PR title is appropriate as title of merge commit
N reviews label is accurate
Moved ticket to Approved column
PR is assigned to only the operator

Operator (before pushing merge the commit)

System administrator

Background migrations for dev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
Background migrations for anvildev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
PR is assigned to only the operator

Operator (before pushing merge the commit)

Operator (chain shortening)

Changed the target branch of the blocked PR to develop _{or this PR is not labeled base}
Removed the chained label from the blocked PR _{or this PR is not labeled base}
Removed the blocking relationship from the blocked PR _{or this PR is not labeled base}
Removed the base label from this PR _{or this PR is not labeled base}

Operator (after pushing the merge commit)

Operator (reindex)

Operator

Propagated the deploy:shared, deploy:gitlab, deploy:runner, API, reindex:partial, reindex:anvilprod and reindex:prod labels to the next promotion PRs _{or this PR carries none of these labels}
Propagated any specific instructions related to the deploy:shared, deploy:gitlab, deploy:runner, API, reindex:partial, reindex:anvilprod and reindex:prod labels, from the description of this PR to that of the next promotion PRs _{or this PR carries none of these labels}
PR is assigned to no one

Shorthand for review comments

L line is too long
W line wrapping is wrong
Q bad quotes
F other formatting problem

codecov · 2024-07-04T01:05:49Z

Codecov Report

Attention: Patch coverage is 71.42857% with 12 lines in your changes missing coverage. Please review.

Project coverage is 85.35%. Comparing base (34a12fb) to head (aebdffd).

Files with missing lines	Patch %	Lines
test/integration_test.py	0.00%	8 Missing ⚠️
src/azul/terraform.py	25.00%	3 Missing ⚠️
test/service/test_app_logging.py	50.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #6385      +/-   ##
===========================================
- Coverage    85.38%   85.35%   -0.03%     
===========================================
  Files          155      155              
  Lines        20754    20778      +24     
===========================================
+ Hits         17720    17736      +16     
- Misses        3034     3042       +8

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

coveralls · 2024-07-04T01:06:03Z

coverage: 84.908% (-0.01%) from 84.92%
when pulling 9839380 on issues/dsotirho-ucsc/154-default-gateway-responses
into 9f12a4f on develop.

coveralls · 2024-07-09T18:35:22Z

coverage: 85.376% (-0.02%) from 85.398%
when pulling aebdffd on issues/dsotirho-ucsc/154-default-gateway-responses
into 34a12fb on develop.

dsotirho-ucsc · 2024-08-19T23:00:01Z

6385_IT_2024-08-19.txt

achave11-ucsc

Please rebase this branch on the latest develop.

dsotirho-ucsc · 2024-09-16T16:31:18Z

6385_IT_2024-09-16.txt

hannes-ucsc · 2024-09-16T16:44:10Z

src/azul/chalice.py

+        # FIXME: Use join_words()
+        #        https://github.com/DataBiosphere/azul-private/issues/6


Just move the necessary commits to this PR.

hannes-ucsc · 2024-09-16T16:45:09Z

src/azul/chalice.py

+        'X-Frame-Options': 'DENY',
+    }
+
+    default_response_headers = {


A comment should explain why they are segregated.

The name of the attribute contradicts the comment. Given the name of the variable, one would expect a "default" to be included in other definitions. You include the other definition in the "default".

hannes-ucsc · 2024-09-16T16:45:21Z

src/azul/chalice.py

+
+    default_response_headers = {
+        **security_headers,
+        # FIXME: Use join_words() and single_quote()


Just move the necessary commits to this PR.

src/azul/chalice.py

dsotirho-ucsc · 2024-09-17T17:15:04Z

6385_IT_2024-09-17.txt

hannes-ucsc · 2024-09-17T18:20:58Z

src/azul/chalice.py

+    # These headers are added to 4XX and 5XX responses from the API Gateway, for
+    # example if an invalid URL was requested (404), or if a request took too
+    # long to complete (504).


Suggested change

# These headers are added to 4XX and 5XX responses from the API Gateway, for

# example if an invalid URL was requested (404), or if a request took too

# long to complete (504).

# These headers are added to 4XX and 5XX responses from API Gateway, for

# example if an invalid URL was requested (404), or if a request took too

# long to complete (504).

It's still not clear from these comments as to why these definitions are separate. You explain the "what" and the "how", but not they "why": Why can't Content-Security-Policy, Referrer-Policy and X-XSS-Protection be part of all Lambda-generated responses?

I see no reason why Referrer-Policy and X-XSS-Protection can't be included in all responses. Content-Security-Policy however (in it's current form) is only suitable for an error response, so will remain separate. (https://github.com/DataBiosphere/azul-private/issues/6 will follow this PR to add the CSP header to all responses.)
In the latest fixup commit I've moved the two headers mentioned above, and rewritten the comments.

dsotirho-ucsc · 2024-09-19T16:08:36Z

6385_IT_2024-09-18.txt

hannes-ucsc · 2024-09-19T18:25:33Z

src/azul/chalice.py

+        'X-Frame-Options': 'DENY',
+    }
+
+    default_response_headers = {


The name of the attribute contradicts the comment. Given the name of the variable, one would expect a "default" to be included in other definitions. You include the other definition in the "default".

)

dsotirho-ucsc · 2024-09-19T22:49:26Z

6385_IT_2024-09-19.txt

github-actions bot added the orange [process] Done by the Azul team label Jul 4, 2024

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/154-default-gateway-responses branch from 9839380 to b3b68a3 Compare July 9, 2024 18:12

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/154-default-gateway-responses branch 10 times, most recently from cd8e187 to add5062 Compare July 16, 2024 18:25

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/154-default-gateway-responses branch 4 times, most recently from 1ced299 to c371d6d Compare August 1, 2024 16:53

dsotirho-ucsc changed the title ~~Fix: 4xx and 5xx responses from API Gateway cause Invicti findings (DataBiosphere/azul#154)~~ Fix: 4xx and 5xx responses from API Gateway cause Invicti findings (DataBiosphere/azul-private#154) Aug 19, 2024

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/154-default-gateway-responses branch 3 times, most recently from bcafdc5 to 531f56e Compare August 19, 2024 22:35

dsotirho-ucsc requested a review from achave11-ucsc August 19, 2024 23:00

dsotirho-ucsc assigned achave11-ucsc Aug 19, 2024

hannes-ucsc force-pushed the develop branch from f54b36e to d769f27 Compare August 20, 2024 22:09

achave11-ucsc removed their assignment Aug 21, 2024

achave11-ucsc reviewed Aug 21, 2024

View reviewed changes

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/154-default-gateway-responses branch from 531f56e to c1bfd01 Compare August 21, 2024 01:12

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/154-default-gateway-responses branch from 67ae8d0 to 00ac1a8 Compare September 16, 2024 15:56

dsotirho-ucsc requested a review from hannes-ucsc September 16, 2024 16:33

dsotirho-ucsc assigned hannes-ucsc Sep 16, 2024

hannes-ucsc requested changes Sep 16, 2024

View reviewed changes

hannes-ucsc removed their assignment Sep 16, 2024

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/154-default-gateway-responses branch from 00ac1a8 to d60bbd1 Compare September 16, 2024 22:42

github-advanced-security bot found potential problems Sep 16, 2024

View reviewed changes

src/azul/chalice.py Fixed Show fixed Hide fixed

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/154-default-gateway-responses branch 2 times, most recently from c2df2c7 to 4c0e620 Compare September 17, 2024 00:34

dsotirho-ucsc assigned hannes-ucsc Sep 17, 2024

dsotirho-ucsc requested a review from hannes-ucsc September 17, 2024 17:15

hannes-ucsc requested changes Sep 17, 2024

View reviewed changes

hannes-ucsc removed their assignment Sep 17, 2024

dsotirho-ucsc added 2 commits September 18, 2024 18:52

Refactor string manipulation functions into strings.py

354bde3

Adjust Strict-Transport-Security header value

5d7f485

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/154-default-gateway-responses branch from 4c0e620 to 8e34e52 Compare September 19, 2024 01:58

dsotirho-ucsc requested a review from hannes-ucsc September 19, 2024 17:05

dsotirho-ucsc assigned hannes-ucsc Sep 19, 2024

hannes-ucsc requested changes Sep 19, 2024

View reviewed changes

hannes-ucsc removed their assignment Sep 19, 2024

dsotirho-ucsc added 3 commits September 19, 2024 15:26

Refactor security headers in AzulChaliceApp, add headers

905fb5f

fixup! Refactor security headers in AzulChaliceApp, add headers

bbc798d

Fix: 4xx and 5xx responses from API Gateway cause Invicti findings (#154

aebdffd

)

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/154-default-gateway-responses branch from 8e34e52 to aebdffd Compare September 19, 2024 22:27

dsotirho-ucsc requested a review from hannes-ucsc September 19, 2024 22:49

dsotirho-ucsc assigned hannes-ucsc Sep 19, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix: 4xx and 5xx responses from API Gateway cause Invicti findings (DataBiosphere/azul-private#154) #6385

Fix: 4xx and 5xx responses from API Gateway cause Invicti findings (DataBiosphere/azul-private#154) #6385

dsotirho-ucsc commented Jul 4, 2024 •

edited

Loading

codecov bot commented Jul 4, 2024 •

edited

Loading

coveralls commented Jul 4, 2024

coveralls commented Jul 9, 2024 •

edited

Loading

dsotirho-ucsc commented Aug 19, 2024

achave11-ucsc left a comment •

edited

Loading

dsotirho-ucsc commented Sep 16, 2024

hannes-ucsc Sep 16, 2024

hannes-ucsc Sep 16, 2024

hannes-ucsc Sep 19, 2024

hannes-ucsc Sep 16, 2024

dsotirho-ucsc commented Sep 17, 2024

hannes-ucsc Sep 17, 2024

dsotirho-ucsc Sep 19, 2024

dsotirho-ucsc commented Sep 19, 2024

hannes-ucsc Sep 19, 2024

dsotirho-ucsc commented Sep 19, 2024

		# FIXME: Use join_words()
		# https://github.com/DataBiosphere/azul-private/issues/6

Fix: 4xx and 5xx responses from API Gateway cause Invicti findings (DataBiosphere/azul-private#154) #6385

Are you sure you want to change the base?

Fix: 4xx and 5xx responses from API Gateway cause Invicti findings (DataBiosphere/azul-private#154) #6385

Conversation

dsotirho-ucsc commented Jul 4, 2024 • edited Loading

Checklist

Author

Author (partiality)

Author (chains)

Author (reindex, API changes)

Author (upgrading deployments)

Author (hotfixes)

Author (before every review)

Peer reviewer (after approval)

System administrator (after approval)

Operator (before pushing merge the commit)

System administrator

Operator (before pushing merge the commit)

Operator (chain shortening)

Operator (after pushing the merge commit)

Operator (reindex)

Operator

Shorthand for review comments

codecov bot commented Jul 4, 2024 • edited Loading

Codecov Report

coveralls commented Jul 4, 2024

coveralls commented Jul 9, 2024 • edited Loading

dsotirho-ucsc commented Aug 19, 2024

achave11-ucsc left a comment • edited Loading

Choose a reason for hiding this comment

dsotirho-ucsc commented Sep 16, 2024

hannes-ucsc Sep 16, 2024

Choose a reason for hiding this comment

hannes-ucsc Sep 16, 2024

Choose a reason for hiding this comment

hannes-ucsc Sep 19, 2024

Choose a reason for hiding this comment

hannes-ucsc Sep 16, 2024

Choose a reason for hiding this comment

dsotirho-ucsc commented Sep 17, 2024

hannes-ucsc Sep 17, 2024

Choose a reason for hiding this comment

dsotirho-ucsc Sep 19, 2024

Choose a reason for hiding this comment

dsotirho-ucsc commented Sep 19, 2024

hannes-ucsc Sep 19, 2024

Choose a reason for hiding this comment

dsotirho-ucsc commented Sep 19, 2024

dsotirho-ucsc commented Jul 4, 2024 •

edited

Loading

codecov bot commented Jul 4, 2024 •

edited

Loading

coveralls commented Jul 9, 2024 •

edited

Loading

achave11-ucsc left a comment •

edited

Loading