Merge pull request #2346 from aboutcode-org/add_altcha_in_ui

Add ALTCHA verification in UI

Author: TG1999

vulnerabilities/forms.py

@@ -133,3 +133,7 @@ class AdvisoryToDoForm(forms.Form):
         choices=[("", "All")] + ISSUE_TYPE_CHOICES,
         widget=forms.Select(attrs={"class": "select"}),
     )
+
+
+class AltchaForm(forms.Form):
+    altcha = AltchaField()

vulnerabilities/middleware/altcha_protection.py

@@ -0,0 +1,42 @@
+#
+# Copyright (c) nexB Inc. and others. All rights reserved.
+# VulnerableCode is a trademark of nexB Inc.
+# SPDX-License-Identifier: Apache-2.0
+# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
+# See https://github.com/aboutcode-org/vulnerablecode for support or download.
+# See https://aboutcode.org for more information about nexB OSS projects.
+#
+
+import time
+
+from django.shortcuts import redirect
+from django.utils.deprecation import MiddlewareMixin
+
+
+class AltchaProtectionMiddleware(MiddlewareMixin):
+    PROTECTED_PREFIXES = (
+        "/packages/",
+        "/vulnerabilities/",
+        "/advisories/",
+        "/affected-by-advisories/v2/",
+        "/fixing-advisories/v2/",
+    )
+
+    SESSION_TIMEOUT = 3600  # 1 hour
+
+    def __call__(self, request):
+        protected = any(request.path.startswith(prefix) for prefix in self.PROTECTED_PREFIXES)
+
+        if not protected:
+            return self.get_response(request)
+
+        verified_at = request.session.get("altcha_verified_at")
+
+        if not verified_at:
+            return redirect(f"/altcha/")
+
+        if time.time() - verified_at > self.SESSION_TIMEOUT:
+            request.session.pop("altcha_verified_at", None)
+            return redirect(f"/altcha/")
+
+        return self.get_response(request)

vulnerabilities/templates/altcha.html

@@ -0,0 +1,5 @@
+<form method="post">
+    {% csrf_token %}
+    {{ form }}
+    <button type="submit">Continue</button>
+</form>

vulnerabilities/tests/test_altcha_protection.py

@@ -0,0 +1,79 @@
+#
+# Copyright (c) nexB Inc. and others. All rights reserved.
+# VulnerableCode is a trademark of nexB Inc.
+# SPDX-License-Identifier: Apache-2.0
+# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
+# See https://github.com/aboutcode-org/vulnerablecode for support or download.
+# See https://aboutcode.org for more information about nexB OSS projects.
+#
+
+import time
+
+import pytest
+from django.test import RequestFactory
+
+from vulnerabilities.forms import AltchaForm
+from vulnerabilities.views import AltchaView
+
+
+@pytest.mark.django_db
+class TestAltchaProtectionMiddleware:
+    def test_protected_url_redirects_without_session(self, client):
+        response = client.get("/packages/search/")
+
+        assert response.status_code == 302
+        assert response.url == "/altcha/"
+
+    def test_unprotected_url_is_accessible(self, client):
+        response = client.get("/")
+
+        assert response.status_code != 302
+
+    def test_protected_url_allowed_with_valid_session(self, client):
+        session = client.session
+        session["altcha_verified_at"] = time.time()
+        session.save()
+
+        response = client.get("/packages/search/")
+
+        assert response.status_code != 302
+
+    def test_expired_session_redirects(self, client):
+        session = client.session
+        session["altcha_verified_at"] = time.time() - 3601
+        session.save()
+
+        response = client.get("/packages/search/")
+
+        assert response.status_code == 302
+        assert response.url == "/altcha/"
+
+    def test_expired_session_is_removed(self, client):
+        session = client.session
+        session["altcha_verified_at"] = time.time() - 3601
+        session.save()
+
+        client.get("/packages/search/")
+
+        session = client.session
+        assert "altcha_verified_at" not in session
+
+
+@pytest.mark.django_db
+class TestAltchaView:
+    def test_form_valid_sets_session(self, monkeypatch):
+        now = 1234567890
+
+        monkeypatch.setattr(time, "time", lambda: now)
+
+        request = RequestFactory().get("/altcha/")
+        request.session = {}
+
+        view = AltchaView()
+        view.request = request
+
+        response = view.form_valid(AltchaForm())
+
+        assert response.status_code == 302
+        assert response.url == "/"
+        assert request.session["altcha_verified_at"] == now

vulnerabilities/tests/test_forms.py

@@ -7,6 +7,9 @@
 # See https://aboutcode.org for more information about nexB OSS projects.
 #
 
+import time
+
+from django.test import Client
 from django.test import TestCase
 
 from vulnerabilities.forms import VulnerabilitySearchForm
@@ -15,6 +18,10 @@
 
 class TestVulnerabilitySearchForm(TestCase):
     def setUp(self) -> None:
+        self.client = Client()
+        session = self.client.session
+        session["altcha_verified_at"] = time.time()
+        session.save()
         self.vulnerability = Vulnerability.objects.create(
             vulnerability_id="VCID-1234",
             summary="test-vuln1",

vulnerabilities/tests/test_view.py

@@ -36,6 +36,9 @@
 class PackageSearchTestCase(TestCase):
     def setUp(self):
         self.client = Client()
+        session = self.client.session
+        session["altcha_verified_at"] = time.time()
+        session.save()
         packages = [
             "pkg:nginx/nginx@0.6.18",
             "pkg:nginx/nginx@1.20.0",
@@ -169,6 +172,9 @@ def setUp(self):
         alias = Alias(alias="TEST-2022", vulnerability=vulnerability)
         alias.save()
         self.client = Client()
+        session = self.client.session
+        session["altcha_verified_at"] = time.time()
+        session.save()
 
     def test_vulnerabilties_search_view_with_vcid_works_and_pk_does_not(self):
         response = self.client.get(f"/vulnerabilities/{self.vulnerability.pk}")
@@ -323,20 +329,28 @@ def setUp(self):
 
         self.vuln1.severities.add(self.severity1)
         self.vuln1.severities.add(self.severity2)
+        self.client = Client()
+        session = self.client.session
+        session["altcha_verified_at"] = time.time()
+        session.save()
         self.vuln1.save()
 
     def test_aggregate_fixed_and_affected_packages(self):
-        with self.assertNumQueries(11):
+        with self.assertNumQueries(12):
             start_time = time.time()
             response = self.client.get(f"/vulnerabilities/{self.vuln1.vulnerability_id}")
             end_time = time.time()
-            assert end_time - start_time < 0.05
+            # Increase time for ALTCHA verification
+            assert end_time - start_time < 0.06
             self.assertEqual(response.status_code, 200)
 
 
 class ThrottleTestCase(TestCase):
     def setUp(self):
         self.client = Client()
+        session = self.client.session
+        session["altcha_verified_at"] = time.time()
+        session.save()
         cache.clear()
 
     def test_throttle_after_15_requests(self):

vulnerabilities/views.py

@@ -9,12 +9,14 @@
 
 import json
 import logging
+import time
 from collections import defaultdict
 from typing import List
 
 from cvss.exceptions import CVSS2MalformedError
 from cvss.exceptions import CVSS3MalformedError
 from cvss.exceptions import CVSS4MalformedError
+from django import forms
 from django.contrib import messages
 from django.contrib.auth.views import LoginView
 from django.core.cache import cache
@@ -34,12 +36,15 @@
 from django.views import generic
 from django.views.generic.detail import DetailView
 from django.views.generic.edit import FormMixin
+from django.views.generic.edit import FormView
 from django.views.generic.list import ListView
+from django_altcha import AltchaField
 
 from vulnerabilities import models
 from vulnerabilities.forms import AdminLoginForm
 from vulnerabilities.forms import AdvisorySearchForm
 from vulnerabilities.forms import AdvisoryToDoForm
+from vulnerabilities.forms import AltchaForm
 from vulnerabilities.forms import ApiUserCreationForm
 from vulnerabilities.forms import PackageSearchForm
 from vulnerabilities.forms import PipelineSchedulePackageForm
@@ -1154,3 +1159,12 @@ def get_context_data(self, **kwargs):
         context["vulnerability_id"] = todo.alias
         context["curation_items"] = json.dumps(todo.issue_detail["curation_items"])
         return context
+
+
+class AltchaView(FormView):
+    template_name = "altcha.html"
+    form_class = AltchaForm
+
+    def form_valid(self, form):
+        self.request.session["altcha_verified_at"] = time.time()
+        return redirect("/")

vulnerablecode/settings.py

@@ -45,6 +45,9 @@
 # SECURITY WARNING: do not run with debug turned on in production
 DEBUG = env.bool("VULNERABLECODE_DEBUG", default=False)
 
+# remove altcha verification once broswer is closed
+SESSION_EXPIRE_AT_BROWSER_CLOSE = True
+
 # SECURITY WARNING: do not  run with debug turned on in production
 DEBUG_TOOLBAR = env.bool("VULNERABLECODE_DEBUG_TOOLBAR", default=False)
 
@@ -108,6 +111,7 @@
     "django.middleware.clickjacking.XFrameOptionsMiddleware",
     "vulnerabilities.middleware.ban_user_agent.BanUserAgent",
     "vulnerabilities.middleware.timezone.UserTimezoneMiddleware",
+    "vulnerabilities.middleware.altcha_protection.AltchaProtectionMiddleware",
 )
 
 ROOT_URLCONF = "vulnerablecode.urls"

vulnerablecode/urls.py

@@ -37,6 +37,7 @@
 from vulnerabilities.views import AdvisoryPackagesDetails
 from vulnerabilities.views import AdvisoryToDoListView
 from vulnerabilities.views import AffectedByAdvisoriesListView
+from vulnerabilities.views import AltchaView
 from vulnerabilities.views import ApiUserCreateView
 from vulnerabilities.views import FixingAdvisoriesListView
 from vulnerabilities.views import HomePage
@@ -144,6 +145,7 @@ def __init__(self, *args, **kwargs):
         AdvisoryDetails.as_view(),
         name="advisory_details",
     ),
+    path("altcha/", AltchaView.as_view(), name="altcha"),
     path(
         "packages/search/",
         PackageSearch.as_view(),