diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 000000000..d4d9a1328 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,95 @@ +# For most projects, this workflow file will not need changing; you simply need +# to commit it to your repository. +# +# You may wish to alter this file to override the set of languages analyzed, +# or to provide custom queries or build logic. +# +# ******** NOTE ******** +# We have attempted to detect the languages in your repository. Please check +# the `language` matrix defined below to confirm you have the correct set of +# supported CodeQL languages. +# +name: "CodeQL" + +on: + push: + branches: [ "main", "production" ] + pull_request: + branches: [ "main", "production" ] + schedule: + - cron: '18 5 * * 3' + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + # Runner size impacts CodeQL analysis time. To learn more, please see: + # - https://gh.io/recommended-hardware-resources-for-running-codeql + # - https://gh.io/supported-runners-and-hardware-resources + # - https://gh.io/using-larger-runners (GitHub.com only) + # Consider using larger runners or machines with greater resources for possible analysis time improvements. + runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} + timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }} + permissions: + # required for all workflows + security-events: write + + # required to fetch internal or private CodeQL packs + packages: read + + # only required for workflows in private repositories + actions: read + contents: read + + strategy: + fail-fast: false + matrix: + include: + - language: javascript-typescript + build-mode: none + - language: python + build-mode: none + # CodeQL supports the following values keywords for 'language': 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' + # Use `c-cpp` to analyze code written in C, C++ or both + # Use 'java-kotlin' to analyze code written in Java, Kotlin or both + # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both + # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis, + # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning. + # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how + # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + + # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs + # queries: security-extended,security-and-quality + + # If the analyze step fails for one of the languages you are analyzing with + # "We were unable to automatically build your code", modify the matrix above + # to set the build mode to "manual" for that language. Then modify this step + # to build your code. + # ℹ️ Command-line programs to run using the OS shell. + # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun + - if: matrix.build-mode == 'manual' + shell: bash + run: | + echo 'If you are using a "manual" build mode for one or more of the' \ + 'languages you are analyzing, replace this with the commands to build' \ + 'your code, for example:' + echo ' make bootstrap' + echo ' make release' + exit 1 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:${{matrix.language}}" diff --git a/Makefile b/Makefile index eb6bb8131..c6f02c3e7 100644 --- a/Makefile +++ b/Makefile @@ -76,8 +76,9 @@ py-test: ## Run python unit tests poetry run coverage html -d .coverage_cache .PHONY: dead-code -dead-code: - poetry run vulture ./app --min-confidence=100 +dead-code: ## 60% is our aspirational goal, but currently breaks the build + poetry run vulture ./app ./notifications_utils --min-confidence=100 + .PHONY: e2e-test e2e-test: export NEW_RELIC_ENVIRONMENT=test diff --git a/app/config.py b/app/config.py index 8ec4db186..77138ca16 100644 --- a/app/config.py +++ b/app/config.py @@ -38,7 +38,7 @@ class Config(object): NR_MONITOR_ON = settings and settings.monitor_mode COMMIT_HASH = getenv("COMMIT_HASH", "--------")[0:7] - GOVERNMENT_EMAIL_DOMAIN_NAMES = ["gov"] + GOVERNMENT_EMAIL_DOMAIN_NAMES = ["gov", "mil", "si.edu"] # Logging NOTIFY_LOG_LEVEL = getenv("NOTIFY_LOG_LEVEL", "INFO") diff --git a/app/main/views/register.py b/app/main/views/register.py index 2829d37bb..7f50c6a19 100644 --- a/app/main/views/register.py +++ b/app/main/views/register.py @@ -26,6 +26,7 @@ from app.main.views import sign_in from app.main.views.verify import activate_user from app.models.user import InvitedOrgUser, InvitedUser, User from app.utils import hide_from_search_engines, hilite +from app.utils.user import is_gov_user @main.route("/register", methods=["GET", "POST"]) @@ -147,6 +148,11 @@ def check_invited_user_email_address_matches_expected( flash("You cannot accept an invite for another person.") abort(403) + if not is_gov_user(user_email): + debug_msg("invited user has a non-government email address.") + flash("You must use a government email address.") + abort(403) + @main.route("/set-up-your-profile", methods=["GET", "POST"]) @hide_from_search_engines diff --git a/app/main/views/send.py b/app/main/views/send.py index abf17fded..aab2db104 100644 --- a/app/main/views/send.py +++ b/app/main/views/send.py @@ -948,7 +948,9 @@ def send_notification(service_id, template_id): vals = ",".join(values) data = f"{data}\r\n{vals}" - filename = f"one-off-{current_user.name}-{uuid.uuid4()}.csv" + filename = ( + f"one-off-{uuid.uuid4()}.csv" # {current_user.name} removed from filename + ) my_data = {"filename": filename, "template_id": template_id, "data": data} upload_id = s3upload(service_id, my_data) form = CsvUploadForm() diff --git a/app/main/views/sign_in.py b/app/main/views/sign_in.py index d00d36892..9f089fe42 100644 --- a/app/main/views/sign_in.py +++ b/app/main/views/sign_in.py @@ -4,7 +4,16 @@ import uuid import jwt import requests -from flask import Response, current_app, redirect, render_template, request, url_for +from flask import ( + Response, + abort, + current_app, + flash, + redirect, + render_template, + request, + url_for, +) from flask_login import current_user from app import login_manager, user_api_client @@ -15,6 +24,7 @@ from app.models.user import User from app.utils import hide_from_search_engines from app.utils.login import is_safe_redirect_url from app.utils.time import is_less_than_days_ago +from app.utils.user import is_gov_user from notifications_utils.url_safe_token import generate_token @@ -88,6 +98,12 @@ def _do_login_dot_gov(): try: access_token = _get_access_token(code, state) user_email, user_uuid = _get_user_email_and_uuid(access_token) + if not is_gov_user(user_email): + current_app.logger.error( + "invited user has a non-government email address." + ) + flash("You must use a government email address.") + abort(403) redirect_url = request.args.get("next") user = user_api_client.get_user_by_uuid_or_email(user_uuid, user_email) diff --git a/app/main/views/sub_navigation_dictionaries.py b/app/main/views/sub_navigation_dictionaries.py index 5e32bc003..5c7cf26ba 100644 --- a/app/main/views/sub_navigation_dictionaries.py +++ b/app/main/views/sub_navigation_dictionaries.py @@ -32,7 +32,7 @@ def using_notify_nav(): "link": "main.trial_mode_new", }, { - "name": "Pricing", + "name": "Tracking usage", "link": "main.pricing", }, { diff --git a/app/s3_client/__init__.py b/app/s3_client/__init__.py index 047ae0bb8..d5fa38189 100644 --- a/app/s3_client/__init__.py +++ b/app/s3_client/__init__.py @@ -40,7 +40,7 @@ def get_s3_object( teststr = str(s3.Bucket(bucket_name).creation_date).lower() if "magicmock" not in teststr: raise Exception( - f"xxxxxtest not mocked, use @mock_aws creation date is {teststr}" + f"Test is not mocked, use @mock_aws or the relevant mocker.patch to avoid accessing S3" ) return obj diff --git a/app/templates/base.html b/app/templates/base.html index 8a6ba1ea8..4a6421afb 100644 --- a/app/templates/base.html +++ b/app/templates/base.html @@ -47,7 +47,7 @@ {% endblock %} {% block content %} {% block flash_messages %} - {% include 'flash_messages.html' %} + {% include 'new/components/flash_messages.html' %} {% endblock %} {% block maincolumn_content %}
diff --git a/app/templates/flash_messages.html b/app/templates/new/components/flash_messages.html similarity index 100% rename from app/templates/flash_messages.html rename to app/templates/new/components/flash_messages.html diff --git a/app/templates/new/components/service_navigation.html b/app/templates/new/components/service_nav.html similarity index 100% rename from app/templates/new/components/service_navigation.html rename to app/templates/new/components/service_nav.html diff --git a/app/templates/settings_nav.html b/app/templates/new/components/settings_nav.html similarity index 100% rename from app/templates/settings_nav.html rename to app/templates/new/components/settings_nav.html diff --git a/app/templates/new/layouts/withnav_template.html b/app/templates/new/layouts/withnav_template.html deleted file mode 100644 index 30d38b4bc..000000000 --- a/app/templates/new/layouts/withnav_template.html +++ /dev/null @@ -1,57 +0,0 @@ -{% extends "/new/base.html" %} - -{% block per_page_title %} - {% block service_page_title %}{% endblock %}{% if current_service.name %} – {{ current_service.name }}{% endif %} - {% block org_page_title %}{% endblock %}{% if current_org.name %} – {{ current_org.name }}{% endif %} -{% endblock %} - -{% block main %} -
- {% block serviceNavigation %} - {% if current_org.name %} - {% else %} - {% include "new/components/service_navigation.html" %} - {% endif %} - {% endblock %} - {# - The withnav_template can serve as a replacement for both settings_template and org_template.html. - - The file service_navigation.html is included only in withnav_template. It's not used in settings_template. That is one out of the two differences between settings template and withnav template. As a result, when other templates extend settings_template, they include the serviceNavigation block but keep it empty. The settings_template.html is specifically used for these pages in the app: manage-users.html, service-settings.html, and user-profile.html. - - In addition, serviceNavigation should be empty on templates that previously extended org_template. For templates that previously extended org_template.html, there's an addition of the orgNavBreadcrumb block. - {% block orgNavBreadcrumb %} - {% include "/new/components/org_nav_breadcrumb.html" %} - {% endblock %} - #} - {% if current_org.name %} - {% block orgNavBreadcrumb %}{% include "/new/components/org_nav_breadcrumb.html" %}{% endblock %} - {% endif %} -
-
- {% block sideNavigation %} - {% if org_navigation_links %} - {% include "/new/components/org_nav.html" %} - {% else %} - {% include "/new/components/main_nav.html" %} - {% endif %} - {# - Include settings_nav.html for child templates that previously extended settings_template. - - Include "org_nav.html" for child templates that previously extended org_template html - #} - {% endblock %} -
-
- {% block beforeContent %} - {% block backLink %}{% endblock %} - {% endblock %} -
- {% block content %} - {% include 'flash_messages.html' %} - {% block maincolumn_content %}{% endblock %} - {% endblock %} -
-
-
-
-{% endblock %} diff --git a/app/templates/main_nav.html b/app/templates/old/main_nav.html similarity index 98% rename from app/templates/main_nav.html rename to app/templates/old/main_nav.html index 4aac354d9..4357dc654 100644 --- a/app/templates/main_nav.html +++ b/app/templates/old/main_nav.html @@ -1,3 +1,4 @@ +{# This template is an old version #} {% if help %} {% include 'partials/tour.html' %} {% else %} diff --git a/app/templates/org_nav.html b/app/templates/old/org_nav.html similarity index 96% rename from app/templates/org_nav.html rename to app/templates/old/org_nav.html index f7f7a5b93..0511eb9ff 100644 --- a/app/templates/org_nav.html +++ b/app/templates/old/org_nav.html @@ -1,3 +1,4 @@ +{# This template is an old version #}