fix(security): bump soupsieve and harden AMC students import

Author: KedroX

examc_app/utils/amc/back/amc_layout_functions.py

@@ -3,7 +3,10 @@
 from dataclasses import dataclass, field
 from pathlib import Path
 
-from PyPDF2 import PdfReader
+try:
+    from pypdf import PdfReader
+except ImportError:
+    from PyPDF2 import PdfReader
 from django.db import transaction
 
 from examc_app.models import (
@@ -607,4 +610,4 @@ def get_subject_copy_and_page_counts_from_xy(xy_path):
         "total_copies": max_copy,
         "pages_per_copy": max_page,
         "total_pages": max_copy * max_page,
-    }
+    }

examc_app/utils/amc_functions.py

@@ -21,7 +21,10 @@
 import pandas as pd
 import xmltodict
 from PIL import Image
-from PyPDF2 import PdfReader, PdfWriter
+try:
+    from pypdf import PdfReader, PdfWriter
+except ImportError:
+    from PyPDF2 import PdfReader, PdfWriter
 from django.conf import settings
 from django.contrib.admin.utils import unquote
 from django.core.exceptions import ValidationError

examc_app/utils/review_functions.py

@@ -141,8 +141,19 @@ def import_scans(exam, path,delete_old,progress_recorder,process_count,process_n
     return result
 
 def create_students_from_amc(exam):
-    students_csv_file_path = get_amc_project_path(exam,False)+"/students.csv"
-    if os.path.exists(students_csv_file_path):
+    amc_project_path = get_amc_project_path(exam, False)
+    if not amc_project_path:
+        return
+
+    amc_root = pathlib.Path(settings.AMC_PROJECTS_ROOT).resolve()
+    students_csv_file_path = (pathlib.Path(amc_project_path) / "students.csv").resolve()
+
+    try:
+        students_csv_file_path.relative_to(amc_root)
+    except ValueError:
+        return
+
+    if students_csv_file_path.is_file():
         line_nr = 0
         headers = None
         with open(students_csv_file_path, newline='', encoding="utf-8") as csv_file:

requirements.txt

@@ -16,7 +16,7 @@ certifi==2025.7.14
 cffi==2.0.0
 chardet==5.2.0
 charset-normalizer==3.4.2
-click==8.2.1
+click==8.3.3
 click-didyoumean==0.3.1
 click-plugins==1.1.1.2
 click-repl==0.3.0
@@ -29,7 +29,7 @@ decorator==5.2.1
 defusedxml==0.7.1
 Deprecated==1.2.18
 diff-match-patch==20241021
-Django==5.2.15
+Django==5.2.16
 django-celery-beat==2.8.1
 django-constance==4.3.3
 django-crispy-forms==2.4
@@ -70,7 +70,7 @@ lxml==6.1.0
 MarkupSafe==3.0.2
 matplotlib==3.10.3
 matplotlib-inline==0.1.7
-mistune==3.2.1
+mistune==3.3.0
 mozilla-django-oidc==4.0.1
 mysqlclient==2.2.7
 narwhals==2.8.0
@@ -88,7 +88,7 @@ parso==0.8.4
 pexpect==4.9.0
 pickleshare==0.7.5
 pikepdf==9.10.2
-pillow==12.2.0
+pillow==12.3.0
 pipreqs==0.5.0
 platformdirs==4.3.8
 plotly==6.3.1
@@ -100,7 +100,7 @@ pycparser==2.22
 Pygments==2.20.0
 pypandoc==1.15
 pyparsing==3.2.3
-PyPDF2==3.0.1
+pypdf==6.14.2
 python-crontab==3.3.0
 python-dateutil==2.9.0.post0
 python-dotenv==1.2.2
@@ -120,7 +120,7 @@ setuptools==80.9.0
 shapely==2.1.1
 six==1.17.0
 snowballstemmer==3.0.1
-soupsieve==2.7
+soupsieve==2.8.4
 Sphinx==8.2.3
 sphinx-basic-ng==1.0.0b2
 sphinxcontrib-applehelp==2.0.0