Resolve "Review Security issues and solve them"

Pelayo Torresrequested to merge
OCF93-review-security-issues-and-solve-them into staging

Closes #93 (closed)

Merge request reports

services/TS29222_CAPIF_API_Invoker_Management_API/requirements.txt

+10 −10
Changes for services/TS29222_CAPIF_API_Invoker_Management_API/requirements.txt: 10 added lines, 10 removed lines.
Original line number Diff line number Diff line
@@ -6,20 +6,20 @@ Flask == 3.0.3 
pymongo == 4.7.3

redis ==  4.5.4

flask_jwt_extended == 4.6.0

cryptography == 42.0.8

cryptography == 43.0.1

rfc3987 == 1.3.8

opentelemetry-instrumentation == 0.40b0

opentelemetry-instrumentation-flask == 0.40b0

opentelemetry-instrumentation-redis == 0.40b0

opentelemetry-instrumentation-pymongo == 0.40b0

opentelemetry-exporter-otlp == 1.19.0

opentelemetry-exporter-jaeger == 1.19.0

opentelemetry-instrumentation == 0.41b0

opentelemetry-instrumentation-flask == 0.41b0

opentelemetry-instrumentation-redis == 0.41b0

opentelemetry-instrumentation-pymongo == 0.41b0

opentelemetry-exporter-otlp == 1.20.0

opentelemetry-exporter-jaeger == 1.20.0

fluent == 0.10.0

fluent-logger == 0.10.0

opentelemetry-api == 1.19.0

opentelemetry-sdk == 1.19.0

opentelemetry-api == 1.20.0

opentelemetry-sdk == 1.20.0

flask_executor == 1.0.0

Flask-APScheduler == 1.13.1

werkzeug == 3.0.4

werkzeug == 3.0.6

gunicorn == 22.0.0

packaging == 24.0
 
 No newline at end of file

services/TS29222_CAPIF_Events_API/capif_events/core/notifications.py

+2 −1
Changes for services/TS29222_CAPIF_Events_API/capif_events/core/notifications.py: 2 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -13,6 +13,7 @@ from flask import current_app 
import asyncio

import aiohttp

from util import dict_to_camel_case, clean_empty, serialize_clean_camel_case

import os



class Notifications():
@@ -67,7 +68,7 @@ class Notifications(): 


    def request_post(self, url, data):

        headers = {'content-type': 'application/json'}

        return requests.post(url, json={'text': str(data.to_str())}, headers=headers)

        return requests.post(url, json={'text': str(data.to_str())}, headers=headers, timeout=os.getenv("TIMEOUT"))

    

    async def send_request(self, url, data):

        async with aiohttp.ClientSession() as session:

services/TS29222_CAPIF_Security_API/capif_security/core/notification.py

+2 −1
Changes for services/TS29222_CAPIF_Security_API/capif_security/core/notification.py: 2 added lines, 1 removed line.
Original line number Diff line number Diff line 
import requests

import os





class Notifications():
@@ -9,4 +10,4 @@ class Notifications(): 


    def request_post(self, url, data):

        headers = {'content-type': 'application/json'}

        return requests.post(url, json={'text': str(data.to_str())}, headers=headers)
 
 No newline at end of file
 
        return requests.post(url, json={'text': str(data.to_str())}, headers=headers, timeout=int(os.getenv("TIMEOUT")))
 
 No newline at end of file

services/mock_server/mock_server.py

+3 −1
Changes for services/mock_server/mock_server.py: 3 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -56,5 +56,7 @@ def requests_list(): 


configure_logging(app)



debug_mode = os.getenv('DEBUG_MODE', 'False').lower() in ['true', '1']



if __name__ == '__main__':

    app.run(host=os.environ.get("IP",'0.0.0.0'),port=os.environ.get("PORT",9100),debug=True)
 
    app.run(host=os.environ.get("IP",'0.0.0.0'),port=os.environ.get("PORT",9100), debug=debug_mode)

services/register/register_service/core/register_operations.py

+2 −1
Changes for services/register/register_service/core/register_operations.py: 2 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -5,6 +5,7 @@ from datetime import datetime 
from config import Config

import requests

import uuid

import os





class RegisterOperations:
@@ -73,7 +74,7 @@ class RegisterOperations: 
        try:



            url = f"https://{self.config["ccf"]["url"]}{self.config["ccf"]["helper_remove_user"]}{uuid}"

            requests.delete(url, cert=("certs/superadmin.crt", "certs/superadmin.key"), verify="certs/ca_root.crt")

            requests.delete(url, cert=("certs/superadmin.crt", "certs/superadmin.key"), verify="certs/ca_root.crt", timeout=int(os.getenv("TIMEOUT")))

            

            mycol.delete_one({"uuid": uuid})

            current_app.logger.debug(f"User with uuid {uuid} removed successfully")