fix: disable ALTCHA session validation by default

related: #2379

Signed-off-by: Keshav Priyadarshi <git@keshav.space>

Author: keshav-space

vulnerabilities/middleware/altcha_protection.py

@@ -13,7 +13,7 @@
 from django.shortcuts import redirect
 from django.utils.deprecation import MiddlewareMixin
 
-SESSION_TIMEOUT = 900  # 15 minutes
+from vulnerablecode.settings import ALTCHA_SESSION_TIMEOUT
 
 ALTCHA_PROTECTED_PREFIXES = (
     "/packages/",
@@ -25,8 +25,10 @@
 
 
 class AltchaProtectionMiddleware(MiddlewareMixin):
-
     def __call__(self, request):
+        if not ALTCHA_SESSION_TIMEOUT:
+            return self.get_response(request)
+
         protected = any(request.path.startswith(prefix) for prefix in ALTCHA_PROTECTED_PREFIXES)
 
         if not protected:
@@ -38,7 +40,7 @@ def __call__(self, request):
         if not verified_at:
             return redirect(f"/altcha/?{urlencode({'next': next_url})}")
 
-        if time.time() - verified_at > SESSION_TIMEOUT:
+        if time.time() - verified_at > ALTCHA_SESSION_TIMEOUT:
             request.session.pop("altcha_verified_at", None)
             return redirect(f"/altcha/?{urlencode({'next': next_url})}")
 

vulnerabilities/tests/test_altcha_protection.py

@@ -13,7 +13,6 @@
 from django.test import RequestFactory
 
 from vulnerabilities.forms import AltchaForm
-from vulnerabilities.views import AltchaView
 
 
 @pytest.mark.django_db
@@ -39,6 +38,7 @@ def test_protected_url_allowed_with_valid_session(self, client):
         assert response.status_code != 302
 
     def test_expired_session_redirects(self, client):
+
         session = client.session
         session["altcha_verified_at"] = time.time() - 3601
         session.save()
@@ -62,6 +62,8 @@ def test_expired_session_is_removed(self, client):
 @pytest.mark.django_db
 class TestAltchaView:
     def test_form_valid_sets_session(self, monkeypatch):
+        from vulnerabilities.views import AltchaView
+
         now = 1234567890
 
         monkeypatch.setattr(time, "time", lambda: now)

vulnerabilities/views.py

@@ -46,7 +46,6 @@
 from vulnerabilities.forms import PackageSearchForm
 from vulnerabilities.forms import PipelineSchedulePackageForm
 from vulnerabilities.forms import VulnerabilitySearchForm
-from vulnerabilities.middleware.altcha_protection import SESSION_TIMEOUT as ALTCHA_SESSION_TIMEOUT
 from vulnerabilities.models import ISSUE_TYPE_CHOICES
 from vulnerabilities.models import AdvisorySetMember
 from vulnerabilities.models import AdvisoryToDoV2
@@ -66,6 +65,7 @@
 from vulnerabilities.utils import get_advisories_from_groups
 from vulnerabilities.utils import safe_altcha_redirect
 from vulnerablecode import __version__ as VULNERABLECODE_VERSION
+from vulnerablecode.settings import ALTCHA_SESSION_TIMEOUT
 from vulnerablecode.settings import env
 
 PAGE_SIZE = 10

vulnerablecode/settings.py

@@ -42,6 +42,8 @@
 
 ALTCHA_HMAC_KEY = env.str("ALTCHA_HMAC_KEY")
 
+ALTCHA_SESSION_TIMEOUT = env.int("ALTCHA_SESSION_TIMEOUT", None)
+
 # SECURITY WARNING: do not run with debug turned on in production
 DEBUG = env.bool("VULNERABLECODE_DEBUG", default=False)
 
@@ -115,6 +117,7 @@
     "vulnerabilities.middleware.vcio_user_agent.VCIOUserAgentMiddleware",
 )
 
+
 ROOT_URLCONF = "vulnerablecode.urls"
 
 WSGI_APPLICATION = "vulnerablecode.wsgi.application"
@@ -215,6 +218,7 @@
 
 if IS_TESTS:
     VULNERABLECODEIO_REQUIRE_AUTHENTICATION = False
+    ALTCHA_SESSION_TIMEOUT = 900
 
 USE_L10N = True
 

vulnerablecode/urls.py

@@ -39,6 +39,7 @@
 from vulnerabilities.views import PipelineRunDetailView
 from vulnerabilities.views import PipelineRunListView
 from vulnerabilities.views import PipelineScheduleListView
+from vulnerablecode.settings import ALTCHA_SESSION_TIMEOUT
 from vulnerablecode.settings import DEBUG
 from vulnerablecode.settings import DEBUG_TOOLBAR
 
@@ -122,7 +123,6 @@ def __init__(self, *args, **kwargs):
         AdvisoryDetails.as_view(),
         name="advisory_details",
     ),
-    path("altcha/", AltchaView.as_view(), name="altcha"),
     path(
         "packages/v2/search/",
         PackageSearchV2.as_view(),
@@ -169,6 +169,9 @@ def __init__(self, *args, **kwargs):
     # ),
 ]
 
+if ALTCHA_SESSION_TIMEOUT:
+    urlpatterns += [path("altcha/", AltchaView.as_view(), name="altcha")]
+
 if DEBUG:
     urlpatterns += [path("django-rq/", include("django_rq.urls"))]