Testing security

Dockerfile

@@ -1,5 +1,5 @@
 # syntax = docker/dockerfile:1.4
-FROM python:3.10 AS compile-stage
+FROM python:3.13.0a4-slim AS compile-stage
 RUN --mount=type=cache,target=/var/cache/apt \
     apt update && \
     apt install -y --no-install-recommends \
@@ -19,3 +19,4 @@ RUN --mount=type=cache,target=/root/.cache \
 
 FROM compile-stage AS tests-stage
 
+USER nobody

Taskfile.yaml

@@ -68,7 +68,7 @@ tasks:
       - docker compose run --rm web python pythonie/manage.py migrate
 
   django:collect-static:
-    desc: Make migrations
+    desc: Make static resources
     cmds:
       - docker compose run --rm web python pythonie/manage.py collectstatic
 

pythonie/core/templates/base.html

@@ -17,7 +17,8 @@
     <meta name="description" content=""/>
     <meta name="viewport" content="width=device-width, initial-scale=1"/>
 
-     <script type="text/javascript" src="//use.typekit.net/qgj1xay.js"></script>
+     <script type="text/javascript" src="//use.typekit.net/qgj1xay.js"
+     integrity="sha384-q8i/X+965DzO0rT7abK41JStQIAqVgRVzpbzo5smXKp4YfRvH+8abtTE1Pi6jizo"></script>
      <script type="text/javascript">try{Typekit.load({async: false});}catch(e){}</script>
 
 
@@ -56,7 +57,10 @@
 {% endcompress %}
 
 {% block basejs %}
-    <script src="https://code.jquery.com/jquery.js"></script>
+    <script src="https://code.jquery.com/jquery-1.12.4.js"
+            integrity="sha256-Qw82+bXyGq6MydymqBxNPYTaUXXq7c8v3CwiYwLLNXU="
+            crossorigin="anonymous"></script>
+
     <script src="{% static 'js/jquery.smartmenus.js' %}"></script>
     <script src="{% static 'js/jquery.smartmenus.bootstrap.js' %}"></script>
     <script src="{% static 'js/bootstrap.min.js' %}"></script>

pythonie/meetups/test_meetups.py

@@ -10,9 +10,9 @@
 description = (
     "<p>We will be having a meetup in June. More details to follow."
     "</p> <p>If you are interested in speaking, please submit your "
-    'details to\xa0<a href="http://bit.ly/pyie-cfp-2015">'
-    '<a href="http://bit.ly/pyie-cfp-2015" class="linkified">'
-    "http://bit.ly/pyie-cfp-2015</a></a>.</p> <p>Enquiries? Please "
+    'details to\xa0<a href="https://bit.ly/pyie-cfp-2015">'
+    '<a href="https://bit.ly/pyie-cfp-2015" class="linkified">'
+    "https://bit.ly/pyie-cfp-2015</a></a>.</p> <p>Enquiries? Please "
     "contact contact@python.ie.</p>"
 )
 
@@ -60,7 +60,7 @@ def _first_result(self):
                     "description": description,
                     "name": "Python Ireland meetup",
                     "event_url": (
-                        "http://www.meetup.com/pythonireland/" "events/221078098/"
+                        "https://www.meetup.com/pythonireland/" "events/221078098/"
                     ),
                     "headcount": 0,
                     "time": 1433957400000,
@@ -123,7 +123,7 @@ def test_update_first_run(self, mock_get_content):
         self.assertEqual(meetup.visibility, "public")
         self.assertEqual(
             meetup.event_url,
-            ("http://www.meetup.com/" "pythonireland/events/221078098/"),
+            ("https://www.meetup.com/" "pythonireland/events/221078098/"),
         )
 
     @patch("meetups.utils.get_content")

pythonie/pythonie/settings/dev.py

@@ -4,7 +4,7 @@
 
 DEBUG = True
 
-SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b"  # Just for dev
+SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b"  # just for dev #nosec B105
 MEETUP_KEY = ""  # Put your own key here.
 # See https://secure.meetup.com/meetup_api/key/
 

pythonie/pythonie/settings/tests.py

@@ -4,7 +4,7 @@
 
 DEBUG = True
 
-SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b"  # Just for dev
+SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b"  #nosec B105 # Just for dev
 MEETUP_KEY = ""  # Put your own key here.
 # See https://secure.meetup.com/meetup_api/key/
 

pythonie/speakers/management/commands/import-sessionize.py

@@ -4,7 +4,6 @@
 import numpy as np
 import pandas as pd
 from django.core.management.base import BaseCommand, CommandParser
-from django.utils.text import slugify
 from wagtail.core.models import Page
 
 from speakers.models import Speaker, Room, Session

pythonie/speakers/management/commands/update-sessionize-json-stream.py

@@ -51,7 +51,7 @@ class SessionizeModel(pydantic.BaseModel):
 
 class Command(BaseCommand):
     def handle(self, *args, **kwargs):
-        response = requests.get("https://sessionize.com/api/v2/z66z4kb6/view/All")
+        response = requests.get("https://sessionize.com/api/v2/z66z4kb6/view/All", timeout=500)
         sessionize: SessionizeModel = SessionizeModel.parse_obj(response.json())
 
         rooms = {}

pythonie/speakers/templates/speakers/session.html

@@ -27,7 +27,7 @@ <h2>{{ self.name }}</h2>
                                         <a href="{% pageurl speaker %}">{{ speaker.name }}</a>
                                     </td>
                                     <td>
-                                        {{ speaker.biography|safe }}
+                                        {{ speaker.biography }}
                                     </td>
                                 </tr>
                             {% endfor %}

requirements/dev.in

@@ -1,10 +1,12 @@
 # dev.in
 -c main.txt
+bandit
 black
 coverage
+django-debug-toolbar
 fakeredis
 flake8
 isort
 model-mommy
-pipdeptree
-django-debug-toolbar
+pip-tools
+pipdeptree

requirements/dev.txt

@@ -1,62 +1,116 @@
-asgiref==3.6.0
+#
+# This file is autogenerated by pip-compile with Python 3.9
+# by the following command:
+#
+#    pip-compile dev.in
+#
+asgiref==3.8.1
     # via
-    #   -c requirements/main.txt
+    #   -c main.txt
     #   django
-async-timeout==4.0.2
+async-timeout==4.0.3
     # via
-    #   -c requirements/main.txt
+    #   -c main.txt
     #   redis
-black==23.3.0
-    # via -r requirements/dev.in
-click==8.1.3
-    # via black
-coverage==7.2.2
-    # via -r requirements/dev.in
-django==3.2.18
+bandit==1.7.8
+    # via -r dev.in
+black==24.3.0
+    # via -r dev.in
+build==1.1.1
+    # via pip-tools
+click==8.1.7
+    # via
+    #   black
+    #   pip-tools
+coverage==7.4.4
+    # via -r dev.in
+django==3.2.25
     # via
-    #   -c requirements/main.txt
+    #   -c main.txt
     #   django-debug-toolbar
     #   model-mommy
-django-debug-toolbar==3.8.1
-    # via -r requirements/dev.in
-fakeredis==2.10.2
-    # via -r requirements/dev.in
-flake8==6.0.0
-    # via -r requirements/dev.in
-isort==5.12.0
-    # via -r requirements/dev.in
+django-debug-toolbar==4.3.0
+    # via -r dev.in
+fakeredis==2.21.3
+    # via -r dev.in
+flake8==7.0.0
+    # via -r dev.in
+importlib-metadata==7.1.0
+    # via build
+isort==5.13.2
+    # via -r dev.in
+markdown-it-py==3.0.0
+    # via rich
 mccabe==0.7.0
     # via flake8
+mdurl==0.1.2
+    # via markdown-it-py
 model-mommy==2.0.0
-    # via -r requirements/dev.in
+    # via -r dev.in
 mypy-extensions==1.0.0
     # via black
-packaging==23.0
-    # via black
-pathspec==0.11.1
+packaging==24.0
+    # via
+    #   -c main.txt
+    #   black
+    #   build
+pathspec==0.12.1
     # via black
-pipdeptree==2.7.0
-    # via -r requirements/dev.in
-platformdirs==3.2.0
+pbr==6.0.0
+    # via stevedore
+pip-tools==7.4.1
+    # via -r dev.in
+pipdeptree==2.16.1
+    # via -r dev.in
+platformdirs==4.2.0
     # via black
-pycodestyle==2.10.0
+pycodestyle==2.11.1
     # via flake8
-pyflakes==3.0.1
+pyflakes==3.2.0
     # via flake8
-pytz==2023.3
+pygments==2.17.2
+    # via rich
+pyproject-hooks==1.0.0
     # via
-    #   -c requirements/main.txt
+    #   build
+    #   pip-tools
+pytz==2024.1
+    # via
+    #   -c main.txt
     #   django
-redis==4.5.4
+pyyaml==6.0.1
+    # via bandit
+redis==5.0.3
     # via
-    #   -c requirements/main.txt
+    #   -c main.txt
     #   fakeredis
+rich==13.7.1
+    # via bandit
 sortedcontainers==2.4.0
     # via fakeredis
-sqlparse==0.4.3
+sqlparse==0.4.4
     # via
-    #   -c requirements/main.txt
+    #   -c main.txt
     #   django
     #   django-debug-toolbar
+stevedore==5.2.0
+    # via bandit
 tomli==2.0.1
-    # via black
+    # via
+    #   black
+    #   build
+    #   pip-tools
+    #   pyproject-hooks
+typing-extensions==4.10.0
+    # via
+    #   -c main.txt
+    #   asgiref
+    #   black
+wheel==0.43.0
+    # via pip-tools
+zipp==3.18.1
+    # via importlib-metadata
+
+# The following packages are considered to be unsafe in a requirements file:
+# pip
+# setuptools

requirements/main.in

@@ -13,15 +13,16 @@ django-libsass
 django-modelcluster
 django-storages
 django-taggit
-gunicorn
+gunicorn>=22.0.0
 pandas
 pydantic
 python-dateutil
 pytz
 redis
 requests
 wagtail
-wagtail-blog
+# important to pin that version until that dependency is removed
+wagtail-blog==2.3.5
 wagtailfontawesome
 wagtailnews
 whitenoise