chaim
0340a670ed
Implements the fixes catalogued under Task Master tasks 1-19, derived from the security audit at .claude/plans/adaptive-sleeping-diffie.md. Critical - C-1 SSRF userinfo bypass: PDF proxy now rejects URLs containing userinfo or non-default ports, and asserts netloc == hostname. - C-2 No authentication: optional NADLAN_API_KEY gate guards /api/search/*, /api/appraisals/pdf and /mcp until Traefik mTLS is wired up. Default behavior unchanged when env unset. High - H-1 Error info leak: HTTPException details replaced with generic string; full exceptions still logged via logger.exception. - H-2 Security headers middleware: HSTS, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy, CSP, server-banner stripped. - H-3 Swagger gated: /api/docs and /api/openapi.json hidden when ENVIRONMENT=production. - H-4 PDF proxy DoS: streams in 8KB chunks, rejects upstream above 50MB Content-Length, also rejects mid-stream overrun. Magic-byte check moved before StreamingResponse so we can 502 cleanly. - H-5 Per-IP rate limit: token-bucket per (path, IP) on /mcp, /api/search/*, /api/appraisals/pdf. Reads X-Forwarded-For for client IP behind Traefik. Medium - M-1 CORS: ALLOWED_ORIGINS env, allow_headers narrowed, no creds. - M-2 Deal model: extra="ignore" + explicit fields for gushNum, parcelNum, subParcelNum, streetNameHeb, houseNum, deal_source, deal_type, deal_type_description, distance_meters. Frontend now reads snake_case. - M-3 Input validators: regex on block, plot, appraiser names, dates, address, free-text — Hebrew + Latin + safe punctuation. - M-4 COOLIFY_UUID moved out of deploy.yaml into Gitea Actions secret. - M-5 Base images pinned to sha256 digests. - M-6 Runtime deps tightened to ~= compatible-release. - M-7 1MB request-body size limit middleware. Low / privacy - L-1 Heebo self-hosted via @fontsource. Removed Google Fonts links and CSP entries. Added meta referrer + meta robots noindex. - L-2 Cache-Control: immutable for /assets, no-cache for HTML. - L-3 Logger no longer prints user-supplied addresses; emits length only. - L-4 Dockerfile healthcheck uses literal port 8000. - L-5 PDF proxy stream cleanup uses contextlib.suppress. Tests: 331 passed, 17 skipped. Frontend typecheck passes. Findings file: .claude/plans/adaptive-sleeping-diffie.md Tasks: .taskmaster/tasks/tasks.json Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
51 lines
1.8 KiB
Docker
51 lines
1.8 KiB
Docker
# ─── Stage 1: build the React UI ────────────────────────────────────────
|
|
# Pinned to digest to neutralize tag-hijack and supply-chain replay.
|
|
# Renovate/dependabot can update this digest periodically.
|
|
FROM node:22-alpine@sha256:8ea2348b068a9544dae7317b4f3aafcdc032df1647bb7d768a05a5cad1a7683f AS web-build
|
|
WORKDIR /web
|
|
|
|
# Cache deps separately from sources.
|
|
COPY web/package.json web/package-lock.json* ./
|
|
RUN npm ci --no-audit --no-fund
|
|
|
|
COPY web/ .
|
|
RUN npm run build
|
|
|
|
# ─── Stage 2: Python runtime ────────────────────────────────────────────
|
|
FROM python:3.13-slim@sha256:a0779d7c12fc20be6ec6b4ddc901a4fd7657b8a6bc9def9d3fde89ed5efe0a3d
|
|
|
|
ENV PYTHONUNBUFFERED=1 \
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
|
PIP_NO_CACHE_DIR=1 \
|
|
PIP_DISABLE_PIP_VERSION_CHECK=1
|
|
|
|
WORKDIR /app
|
|
|
|
# gcc — for any pure-Python wheels without prebuilt slim wheels.
|
|
# curl — Coolify runs its healthcheck via curl inside the container.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends gcc curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install Python deps from pyproject.
|
|
COPY pyproject.toml README.md ./
|
|
RUN pip install --no-cache-dir .
|
|
|
|
# App code.
|
|
COPY nadlan_mcp/ ./nadlan_mcp/
|
|
COPY run_http_server.py ./
|
|
|
|
# React build artifacts → web/dist (where web_app.py looks for them).
|
|
COPY --from=web-build /web/dist ./web/dist
|
|
|
|
# Non-root user.
|
|
RUN useradd -m -u 1000 appuser && chown -R appuser:appuser /app
|
|
USER appuser
|
|
|
|
EXPOSE 8000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
|
|
CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')" || exit 1
|
|
|
|
CMD ["python", "run_http_server.py"]
|