Kitos
64d64080e0
Critical (1-3): - Replace hardcoded admin credentials with secure auto-generation (seed.py) - Enforce SECRET_KEY configuration, fail in production if missing (config.py) - Add Zip Slip and Zip Bomb protection to all ZIP import services High/Medium (4-9): - Add 50MB file size limit and extension whitelist to evidence uploads - Configure CORS origins via environment variable instead of hardcoded - Migrate JWT storage from localStorage to HttpOnly cookies (frontend+backend) - Add rate limiting (5/min) on login endpoint via slowapi - Replace generic dict payloads with Pydantic schemas (mass assignment) Medium (10-17): - Check is_active on login to prevent disabled users from authenticating - Sanitize exception messages in API responses (system, data_sources) - Escape LIKE wildcards in all ilike search filters across 8 routers - Run Docker container as non-root user (appuser) - Make MINIO_SECURE configurable via environment variable - Add password complexity policy (12+ chars, upper/lower/digit/special) - Implement JWT token revocation via in-memory blacklist + reduce TTL to 15min - Replace xml.etree with defusedxml to prevent Billion Laughs attacks Low (18-20): - Add security headers to Nginx (CSP, X-Frame-Options, HSTS-ready, etc.) - Disable Swagger UI/ReDoc/OpenAPI in production - Restrict /health endpoint to internal networks via Nginx ACL Also: rewrite install.sh as interactive wizard for guided deployment, fix test-from-template validation error (technique_id UUID vs MITRE ID)
79 lines
2.4 KiB
Python
79 lines
2.4 KiB
Python
"""Pydantic schemas for TestTemplate endpoints."""
|
|
|
|
import uuid
|
|
from datetime import datetime
|
|
|
|
from pydantic import BaseModel, ConfigDict
|
|
|
|
|
|
# ── Full output ─────────────────────────────────────────────────────
|
|
|
|
|
|
class TestTemplateOut(BaseModel):
|
|
"""Complete representation of a test template."""
|
|
|
|
id: uuid.UUID
|
|
mitre_technique_id: str
|
|
name: str
|
|
description: str | None = None
|
|
source: str
|
|
source_url: str | None = None
|
|
attack_procedure: str | None = None
|
|
expected_detection: str | None = None
|
|
platform: str | None = None
|
|
tool_suggested: str | None = None
|
|
severity: str | None = None
|
|
atomic_test_id: str | None = None
|
|
suggested_remediation: str | None = None
|
|
is_active: bool = True
|
|
created_at: datetime | None = None
|
|
|
|
model_config = ConfigDict(from_attributes=True)
|
|
|
|
|
|
# ── Create ──────────────────────────────────────────────────────────
|
|
|
|
|
|
class TestTemplateCreate(BaseModel):
|
|
"""Payload for creating a custom test template."""
|
|
|
|
mitre_technique_id: str
|
|
name: str
|
|
description: str | None = None
|
|
source: str = "custom"
|
|
source_url: str | None = None
|
|
attack_procedure: str | None = None
|
|
expected_detection: str | None = None
|
|
platform: str | None = None
|
|
tool_suggested: str | None = None
|
|
severity: str | None = None
|
|
atomic_test_id: str | None = None
|
|
suggested_remediation: str | None = None
|
|
|
|
|
|
# ── Summary (for listings) ─────────────────────────────────────────
|
|
|
|
|
|
class TestTemplateSummary(BaseModel):
|
|
"""Lightweight representation for listing templates."""
|
|
|
|
id: uuid.UUID
|
|
mitre_technique_id: str
|
|
name: str
|
|
source: str
|
|
platform: str | None = None
|
|
severity: str | None = None
|
|
is_active: bool = True
|
|
|
|
model_config = ConfigDict(from_attributes=True)
|
|
|
|
|
|
# ── Instantiate (create a real Test from a template) ────────────────
|
|
|
|
|
|
class TestTemplateInstantiate(BaseModel):
|
|
"""Payload to create a real test from an existing template."""
|
|
|
|
template_id: uuid.UUID
|
|
technique_id: str # accepts both UUID and MITRE ID (e.g. "T1059.001")
|