security: address all findings from vulnerability assessment
Implements the fixes catalogued under Task Master tasks 1-19, derived
from the security audit at .claude/plans/adaptive-sleeping-diffie.md.
Critical
- C-1 SSRF userinfo bypass: PDF proxy now rejects URLs containing
userinfo or non-default ports, and asserts netloc == hostname.
- C-2 No authentication: optional NADLAN_API_KEY gate guards
/api/search/*, /api/appraisals/pdf and /mcp until Traefik mTLS
is wired up. Default behavior unchanged when env unset.
High
- H-1 Error info leak: HTTPException details replaced with generic
string; full exceptions still logged via logger.exception.
- H-2 Security headers middleware: HSTS, X-Frame-Options, nosniff,
Referrer-Policy, Permissions-Policy, CSP, server-banner stripped.
- H-3 Swagger gated: /api/docs and /api/openapi.json hidden when
ENVIRONMENT=production.
- H-4 PDF proxy DoS: streams in 8KB chunks, rejects upstream above
50MB Content-Length, also rejects mid-stream overrun. Magic-byte
check moved before StreamingResponse so we can 502 cleanly.
- H-5 Per-IP rate limit: token-bucket per (path, IP) on /mcp,
/api/search/*, /api/appraisals/pdf. Reads X-Forwarded-For for
client IP behind Traefik.
Medium
- M-1 CORS: ALLOWED_ORIGINS env, allow_headers narrowed, no creds.
- M-2 Deal model: extra="ignore" + explicit fields for gushNum,
parcelNum, subParcelNum, streetNameHeb, houseNum, deal_source,
deal_type, deal_type_description, distance_meters. Frontend now
reads snake_case.
- M-3 Input validators: regex on block, plot, appraiser names,
dates, address, free-text — Hebrew + Latin + safe punctuation.
- M-4 COOLIFY_UUID moved out of deploy.yaml into Gitea Actions
secret.
- M-5 Base images pinned to sha256 digests.
- M-6 Runtime deps tightened to ~= compatible-release.
- M-7 1MB request-body size limit middleware.
Low / privacy
- L-1 Heebo self-hosted via @fontsource. Removed Google Fonts links
and CSP entries. Added meta referrer + meta robots noindex.
- L-2 Cache-Control: immutable for /assets, no-cache for HTML.
- L-3 Logger no longer prints user-supplied addresses; emits length
only.
- L-4 Dockerfile healthcheck uses literal port 8000.
- L-5 PDF proxy stream cleanup uses contextlib.suppress.
Tests: 331 passed, 17 skipped. Frontend typecheck passes.
Findings file: .claude/plans/adaptive-sleeping-diffie.md
Tasks: .taskmaster/tasks/tasks.json
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
chaim
0340a670ed