fix: disable ALTCHA session validation by default

related: #2379

Signed-off-by: Keshav Priyadarshi <git@keshav.space>

Author: keshav-space

vulnerabilities/middleware/altcha_protection.py

@@ -13,7 +13,7 @@
 from django.shortcuts import redirect
 from django.utils.deprecation import MiddlewareMixin
 
-SESSION_TIMEOUT = 900  # 15 minutes
+from vulnerablecode.settings import ALTCHA_SESSION_TIMEOUT
 
 ALTCHA_PROTECTED_PREFIXES = (
     "/packages/",
@@ -25,8 +25,10 @@
 
 
 class AltchaProtectionMiddleware(MiddlewareMixin):
-
     def __call__(self, request):
+        if not ALTCHA_SESSION_TIMEOUT:
+            return self.get_response(request)
+
         protected = any(request.path.startswith(prefix) for prefix in ALTCHA_PROTECTED_PREFIXES)
 
         if not protected:
@@ -38,7 +40,7 @@ def __call__(self, request):
         if not verified_at:
             return redirect(f"/altcha/?{urlencode({'next': next_url})}")
 
-        if time.time() - verified_at > SESSION_TIMEOUT:
+        if time.time() - verified_at > ALTCHA_SESSION_TIMEOUT:
             request.session.pop("altcha_verified_at", None)
             return redirect(f"/altcha/?{urlencode({'next': next_url})}")
 

vulnerabilities/views.py

@@ -46,7 +46,6 @@
 from vulnerabilities.forms import PackageSearchForm
 from vulnerabilities.forms import PipelineSchedulePackageForm
 from vulnerabilities.forms import VulnerabilitySearchForm
-from vulnerabilities.middleware.altcha_protection import SESSION_TIMEOUT as ALTCHA_SESSION_TIMEOUT
 from vulnerabilities.models import ISSUE_TYPE_CHOICES
 from vulnerabilities.models import AdvisorySetMember
 from vulnerabilities.models import AdvisoryToDoV2
@@ -66,6 +65,7 @@
 from vulnerabilities.utils import get_advisories_from_groups
 from vulnerabilities.utils import safe_altcha_redirect
 from vulnerablecode import __version__ as VULNERABLECODE_VERSION
+from vulnerablecode.settings import ALTCHA_SESSION_TIMEOUT
 from vulnerablecode.settings import env
 
 PAGE_SIZE = 10

vulnerablecode/settings.py

@@ -42,6 +42,8 @@
 
 ALTCHA_HMAC_KEY = env.str("ALTCHA_HMAC_KEY")
 
+ALTCHA_SESSION_TIMEOUT = env.int("ALTCHA_SESSION_TIMEOUT", None)
+
 # SECURITY WARNING: do not run with debug turned on in production
 DEBUG = env.bool("VULNERABLECODE_DEBUG", default=False)
 
@@ -111,10 +113,12 @@
     "django.middleware.clickjacking.XFrameOptionsMiddleware",
     "vulnerabilities.middleware.ban_user_agent.BanUserAgent",
     "vulnerabilities.middleware.timezone.UserTimezoneMiddleware",
-    "vulnerabilities.middleware.altcha_protection.AltchaProtectionMiddleware",
     "vulnerabilities.middleware.vcio_user_agent.VCIOUserAgentMiddleware",
 )
 
+if ALTCHA_SESSION_TIMEOUT:
+    MIDDLEWARE += ("vulnerabilities.middleware.altcha_protection.AltchaProtectionMiddleware",)
+
 ROOT_URLCONF = "vulnerablecode.urls"
 
 WSGI_APPLICATION = "vulnerablecode.wsgi.application"

vulnerablecode/urls.py

@@ -39,6 +39,7 @@
 from vulnerabilities.views import PipelineRunDetailView
 from vulnerabilities.views import PipelineRunListView
 from vulnerabilities.views import PipelineScheduleListView
+from vulnerablecode.settings import ALTCHA_SESSION_TIMEOUT
 from vulnerablecode.settings import DEBUG
 from vulnerablecode.settings import DEBUG_TOOLBAR
 
@@ -122,7 +123,6 @@ def __init__(self, *args, **kwargs):
         AdvisoryDetails.as_view(),
         name="advisory_details",
     ),
-    path("altcha/", AltchaView.as_view(), name="altcha"),
     path(
         "packages/v2/search/",
         PackageSearchV2.as_view(),
@@ -169,6 +169,9 @@ def __init__(self, *args, **kwargs):
     # ),
 ]
 
+if ALTCHA_SESSION_TIMEOUT:
+    urlpatterns += [path("altcha/", AltchaView.as_view(), name="altcha")]
+
 if DEBUG:
     urlpatterns += [path("django-rq/", include("django_rq.urls"))]