Skip to content

fix: sync main with develop (CodeQL alert #15 fix) #135

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
overwrite00 merged 5 commits into from
Jul 13, 2026
+165 −113
Merged

fix: sync main with develop (CodeQL alert #15 fix) #135

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
412ec01
chore(deps-backend)(deps): bump the minor-and-patch group across 1 di…
dependabot[bot] Jul 2, 2026
f75d8d9
chore(deps-backend)(deps): bump the minor-and-patch group (#130)
dependabot[bot] Jul 13, 2026
2306bd8
chore(deps-frontend)(deps): bump the minor-and-patch group (#131)
dependabot[bot] Jul 13, 2026
104629c
chore(deps-frontend)(deps-dev): bump the development-updates group ac…
dependabot[bot] Jul 13, 2026
e333250
fix: prevent stack trace exposure in URLScan.io health check endpoint
overwrite00 Jul 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions backend/api/routes/reputation.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -703,8 +703,9 @@ async def test_urlscan_health():
try:
resp = requests.head("https://urlscan.io/api/v1/search/", timeout=5)
result["connectivity"] = True
except Exception as e:
result["suggestions"].append(f"URLScan.io non raggiungibile: {type(e).__name__}")
except Exception:
_logger.warning("URLScan.io health check: connectivity test failed", exc_info=True)
result["suggestions"].append("URLScan.io non raggiungibile. Verifica la connessione di rete.")
return result

# Test 2: API key configurato?
Expand All @@ -729,8 +730,9 @@ async def test_urlscan_health():
result["suggestions"].append("HTTP 403 Forbidden. Possibili cause: 1) Rate limit superato (1000 req/giorno), 2) IP blacklisted, 3) API key non valida. Verifica urlscan.io/user/settings")
else:
result["suggestions"].append(f"URLScan.io HTTP {resp.status_code}. Risposta: {resp.text[:100]}")
except Exception as e:
result["suggestions"].append(f"Errore test API key: {type(e).__name__}: {str(e)[:100]}")
except Exception:
_logger.warning("URLScan.io health check: API key test failed", exc_info=True)
result["suggestions"].append("Errore durante il test della API key. Controlla i log del server per dettagli.")
else:
result["suggestions"].append("URLSCAN_API_KEY non configurato in .env. Registrati su https://urlscan.io/user/signup e configura la chiave per aumentare il limite a 1000 req/giorno")

Expand Down
10 changes: 5 additions & 5 deletions backend/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,16 +3,16 @@
# Versioni pinnate per riproducibilità

# Web framework
fastapi==0.138.0
fastapi==0.139.0
pydantic==2.13.4
pydantic-settings==2.14.2
uvicorn[standard]==0.49.0
uvicorn[standard]==0.50.0
python-multipart==0.0.32

# Email parsing
mail-parser==4.4.0
python-oxmsg==0.0.2
beautifulsoup4==4.14.0
beautifulsoup4==4.15.0

# Optional: RTF decompression for legacy .msg files (Outlook <2010)
# Uncomment if you receive email from Outlook 97-2003 with RTF-only body:
Expand All @@ -38,13 +38,13 @@ aiosqlite==0.22.1
# Security / sanitization
bleach==6.4.0
tinycss2>=1.3.0
slowapi==0.1.9
slowapi==0.1.10

# Dev & test
pytest==9.1.1
pytest-asyncio==1.4.0
httpx==0.28.1
coverage==7.6.1
coverage==7.15.0

# Language detection
langdetect==1.0.9
Expand Down
Loading