Harden security: enable Jinja2 autoescape, add SQL table whitelist, enforce HTTPS

core/utils_db.py

@@ -9,6 +9,17 @@
 # Default master database
 MASTER_DATABASE = "datasets/data.db"
 
+ALLOWED_TABLES = {
+    "resourcetype",
+    "resource_inventory",
+    "cost_inventory",
+    "risk_inventory",
+    "scoring_data",
+    "alternative",
+    "alternativetechnology",
+    "risk",
+}
+
 
 def connect(db_path=MASTER_DATABASE):
     try:
@@ -20,6 +31,8 @@ def connect(db_path=MASTER_DATABASE):
 
 
 def load_data(table_name, db_path=MASTER_DATABASE):
+    if table_name not in ALLOWED_TABLES:
+        raise ValueError(f"Disallowed table name: {table_name}")
     try:
         conn = connect(db_path)
         cursor = conn.cursor()

core/utils_report.py

@@ -3,7 +3,7 @@
 import json
 import logging
 from typing import Any
-from jinja2 import Template
+from jinja2 import Environment
 
 # ReportLab
 from reportlab.lib.pagesizes import A4
@@ -134,7 +134,8 @@ def generate_html_report(
     with open(template_path, "r") as file:
         template_content = file.read()
 
-    template = Template(template_content)
+    env = Environment(autoescape=True)
+    template = env.from_string(template_content)
     html_content = template.render(
         **metadata,
         **scoring_context,

core/utils_sync.py

@@ -20,7 +20,9 @@
 
 def _assess_url(host: str) -> str:
     host = host.strip().rstrip("/")
-    if not host.startswith("http"):
+    if host.startswith("http://"):
+        host = "https://" + host[len("http://") :]
+    elif not host.startswith("https://"):
         host = f"https://{host}"
     return f"{host}{_ASSESS_PATH}"
 

utils/connection.py

@@ -16,7 +16,9 @@
 
 def _build_url(host: str) -> str:
     host = host.strip().rstrip("/")
-    if not host.startswith("http"):
+    if host.startswith("http://"):
+        host = "https://" + host[len("http://") :]
+    elif not host.startswith("https://"):
         host = f"https://{host}"
     return f"{host}{_AUTH_PATH}"
 

utils/sync.py

@@ -14,7 +14,9 @@
 
 def _build_url(host: str) -> str:
     host = host.strip().rstrip("/")
-    if not host.startswith("http"):
+    if host.startswith("http://"):
+        host = "https://" + host[len("http://") :]
+    elif not host.startswith("https://"):
         host = f"https://{host}"
     return f"{host}{_ASSESS_PATH}"