Security & Quality Improvements: Fix Critical CVEs and Enhance Code Quality#12
Merged
gauravtayade11 merged 7 commits intodevelopfrom Feb 5, 2026
Merged
Conversation
- Add comprehensive optimization service with performance risk detection - Implement feature flags system for gradual feature rollout - Add centralized navigation configuration - Enhance AI routes with optimization context - Update terminal components with improved error handling - Refactor layout components for better maintainability
Adds optimization enhancements and feature flag system for better resource management and gradual feature rollout.
Security fixes: - Make admin password validation CRITICAL in production (startup.py) - Add OAuth secret validation to prevent misconfiguration - Add minimum password length check (8 characters) - Remove unsafe-eval and unsafe-inline from CSP headers (middleware.py) - Add comprehensive kubectl command validation with whitelist - Block command injection patterns and destructive operations - Restrict kubectl to read-only commands (get, describe, logs, top, etc.)
- Update vulnerable dependencies (authlib>=1.6.6, python-multipart>=0.0.22) - Add critical security warnings for token blacklist fallback - Enhance token blacklist logging for production monitoring - Add request size limits to ChatRequest (message: 10K, context: 50K) - Prevent DoS attacks via large prompts
- Add Kubernetes name format validation for pod names and namespaces - Prevent command injection via malformed pod identifiers - Use regex validation matching K8s naming conventions (RFC 1123)
- Replace generic Exception catches with specific exception types - Add ImportError for module imports - Add ApiException for Kubernetes API calls - Add AttributeError and ValueError where appropriate - Improves error diagnosis and prevents masking unexpected errors Progress: ~60% of ai.py exceptions replaced Remaining: AI provider errors, service-specific errors
- Replace AI provider errors with OSError, ValueError - Replace service errors with specific exception types - Add ApiException for Kubernetes API calls - Add OSError for Jenkins, Helm service calls - Keep strategic catch-alls for endpoint error handling - Improve error logging with exception types Progress: ~70% of ai.py exceptions now use specific types Remaining: ~15 endpoint-level catch-alls (acceptable)
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| f"SECURITY WARNING: Redis unavailable for token blacklist, using in-memory fallback. " | ||
| f"Blacklisted tokens will be forgotten on restart! Error: {e}" | ||
| ) | ||
| _redis_unavailable_logged = True |
Check notice
Code scanning / CodeQL
Unused global variable Note
Copilot Autofix
AI 2 months ago
Copilot could not generate an autofix suggestion
Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.
| "SECURITY WARNING: Redis is disabled. Token blacklist using in-memory storage. " | ||
| "Blacklisted tokens will be forgotten on restart! Enable Redis for production." | ||
| ) | ||
| _redis_unavailable_logged = True |
Check notice
Code scanning / CodeQL
Unused global variable Note
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 months ago
In general, to fix an “unused global variable” at module scope, you either (1) remove the variable and its writes if truly unused, keeping only side‑effects from the right‑hand side, or (2) if it is needed but should not be global, move the state into a narrower scope (e.g., inside a function or class) or rename it to indicate intentional unusedness. Here, _redis_unavailable_logged is clearly used as a per‑process flag to avoid logging the same critical message multiple times. That behavior must be preserved, but there is no need for other modules to access or modify this flag. Therefore, the best fix is to eliminate _redis_unavailable_logged as a global variable and instead maintain equivalent state entirely inside _get_redis_client().
Concretely, within backend/app/core/security.py, we will:
- Remove the module‑level definition
_redis_unavailable_logged = False. - Introduce a function‑local, mutable holder (e.g., a dictionary or a simple attribute on the function) in
_get_redis_client()that tracks whether an “unavailable/disabled” message has already been logged. - Replace the
global _redis_unavailable_loggeddeclaration and all references to_redis_unavailable_loggedwith reads/writes to this function‑local state.
This preserves the “log once” behavior, avoids new dependencies, and removes the unused global per CodeQL’s definition, without changing any external interface or observable behavior outside_get_redis_client().
Suggested changeset
1
backend/app/core/security.py
| @@ -28,12 +28,20 @@ | ||
| _token_blacklist_memory: Set[str] = set() | ||
| _blacklist_cleanup_time: Optional[datetime] = None | ||
| _redis_client = None | ||
| _redis_unavailable_logged = False | ||
|
|
||
|
|
||
| def _get_redis_client(): | ||
| """Get or create Redis client for token blacklist.""" | ||
| global _redis_client, _redis_unavailable_logged | ||
| global _redis_client | ||
|
|
||
| # Track whether we've already logged Redis unavailability/disabled status. | ||
| # Using a function-local mutable holder avoids a module-level global flag | ||
| # while preserving the "log only once" behavior. | ||
| if not hasattr(_get_redis_client, "_unavailable_logged"): | ||
| setattr(_get_redis_client, "_unavailable_logged", False) | ||
|
|
||
| unavailable_logged = getattr(_get_redis_client, "_unavailable_logged") | ||
|
|
||
| if _redis_client is None and settings.REDIS_ENABLED: | ||
| try: | ||
| import redis | ||
| @@ -43,20 +47,20 @@ | ||
| logger.info("Token blacklist using Redis (production-ready)") | ||
| return _redis_client | ||
| except Exception as e: | ||
| if not _redis_unavailable_logged: | ||
| if not unavailable_logged: | ||
| logger.critical( | ||
| f"SECURITY WARNING: Redis unavailable for token blacklist, using in-memory fallback. " | ||
| f"Blacklisted tokens will be forgotten on restart! Error: {e}" | ||
| ) | ||
| _redis_unavailable_logged = True | ||
| setattr(_get_redis_client, "_unavailable_logged", True) | ||
| _redis_client = False # Mark as unavailable | ||
| elif _redis_client is None and not settings.REDIS_ENABLED: | ||
| if not _redis_unavailable_logged: | ||
| if not unavailable_logged: | ||
| logger.critical( | ||
| "SECURITY WARNING: Redis is disabled. Token blacklist using in-memory storage. " | ||
| "Blacklisted tokens will be forgotten on restart! Enable Redis for production." | ||
| ) | ||
| _redis_unavailable_logged = True | ||
| setattr(_get_redis_client, "_unavailable_logged", True) | ||
| _redis_client = False | ||
| return _redis_client if _redis_client else None | ||
|
|
Copilot is powered by AI and may make mistakes. Always verify output.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔐 Security & Quality Improvements
This PR addresses critical security vulnerabilities, updates dependencies with known CVEs, and significantly improves code quality through better exception handling.
📋 Summary
🔴 Critical Security Fixes
1. Hardcoded Credentials Protection
backend/app/core/startup.py2. Content Security Policy Hardening
backend/app/core/middleware.pyunsafe-evalandunsafe-inlinefrom CSP headersobject-src 'none'for additional XSS protectionwss:) for real-time features3. Kubectl Command Injection Prevention
backend/app/services/kubernetes_service.py;,&&,||,$(), backticks)⚡ High Priority Security Updates
4. Dependency CVE Fixes
backend/requirements.txtauthlib: 1.6.5 → 1.6.6 (fixes CVE-2025-62706)python-multipart: 0.0.18 → 0.0.22 (fixes CVE-2024-53981)5. Token Blacklist Security Enhancement
backend/app/core/security.py6. Request Size Limits (DoS Prevention)
backend/app/api/routes/ai.py7. Pod Name Validation
frontend/src/components/kubernetes/PodExecTerminal.tsx📊 Exception Handling Improvements
8. Specific Exception Types (70% Complete)
backend/app/api/routes/ai.pyExceptioncatches with specific typesImportErrorApiExceptionOSError,ValueError,AttributeErrorOSError,RuntimeError📈 Impact Metrics
✅ Testing Checklist
🚀 Deployment Notes
Environment Variables Required
Ensure these are set in production:
Breaking Changes
SECRET_KEYis still the default valueDEFAULT_ADMIN_PASSWORDis weak (admin123, admin, password, etc.)This is intentional security hardening.
📝 Files Changed
Backend (7 files):
backend/requirements.txt- Dependency updatesbackend/app/core/config.py- Configuration (no code changes, linter only)backend/app/core/startup.py- Security validation enhancementsbackend/app/core/middleware.py- CSP hardeningbackend/app/core/security.py- Token blacklist warningsbackend/app/services/kubernetes_service.py- Command injection preventionbackend/app/api/routes/ai.py- Exception handling + size limitsFrontend (1 file):
frontend/src/components/kubernetes/PodExecTerminal.tsx- Pod name validation🔗 Related Issues
Closes: (add issue numbers if applicable)
👥 Reviewers
Please review: