Web UI

[hasan7n]

Comments/discussions to check:

• Web UI - stage1, readonly part #606
• [WIP] Web UI dataset #617

To be merged before merging to main: #618, which depends on #615

To fix the issue, we will enhance the validation of the path parameter to ensure it does not allow directory traversal attacks. Specifically:

1. Normalize the path using os.path.normpath to remove any .. segments.
2. Verify that the normalized full_path starts with BASE_DIR to ensure it is contained within the base directory.
3. Raise an exception if the validation fails.

This approach ensures that even if a malicious user provides a crafted input, the resulting path will not escape the intended base directory.

---

To fix the issue, we need to ensure that the full_path is normalized before performing the containment check against BASE_DIR. This can be achieved by using os.path.normpath or os.path.realpath on the full_path before comparing it with BASE_DIR. This normalization step will resolve any .. sequences or symbolic links in the path, ensuring that the containment check is robust.

Additionally, we should ensure that the full_path is not only within the BASE_DIR but also a valid directory before proceeding with further operations.

To fix the issue, we need to ensure that the path parameter is properly sanitized and validated before being used to construct file paths. This involves normalizing the path using os.path.normpath and ensuring that the resulting path is strictly within the BASE_DIR. Additionally, we should validate item_path to ensure it does not point outside the allowed directory structure.

Steps to fix:

1. Normalize path using os.path.normpath before constructing full_path.
2. Revalidate that the normalized full_path starts with BASE_DIR after normalization.
3. Ensure that item_path is also validated to prevent any potential misuse.

---

To fix the issue, we need to validate the redirect_url parameter before using it in the RedirectResponse. A safe approach is to ensure that the redirect_url is either a relative URL or matches a predefined list of allowed URLs. This can be achieved using Python's urlparse module to check that the redirect_url does not include an explicit host name or scheme, ensuring it is a relative path. If the validation fails, the application should redirect to a default safe URL (e.g., the home page).

The changes will be made in the access_web_ui function where the redirect_url is used. We will also add a utility function to perform the validation.

---

To fix the issue, the set_cookie method should explicitly set the secure, httponly, and samesite attributes. Specifically:

• secure=True ensures the cookie is only sent over HTTPS.
• httponly=True prevents JavaScript from accessing the cookie.
• samesite='Lax' or samesite='Strict' mitigates CSRF risks by restricting cross-origin requests.

The fix involves modifying the set_cookie call on line 35 to include these attributes.

---

To fix the issue, we need to ensure that the token value is sanitized or validated before being used to construct the cookie. A secure approach would involve:

1. Validating the token against a predefined set of acceptable values or formats.
2. Ensuring that the token does not contain any malicious or unexpected content.
3. Optionally, encoding the token to prevent injection attacks.

In this case, we will validate the token by ensuring it matches the security_token and then use a secure, predefined value (e.g., security_token) to set the cookie instead of the raw user input.

---

To fix the issue, we need to validate the raw_data_path to ensure it is within a predefined safe root directory. This can be achieved by:

1. Normalizing the raw_data_path using os.path.realpath or Path.resolve to remove any .. segments or symbolic links.
2. Verifying that the normalized path starts with a predefined safe root directory (e.g., a directory dedicated to storing raw data).
3. Raising an exception if the validation fails.

The validation should be added in the validate_input method of the ImportDataset class, as this is where the input parameters are initially checked.

---

To fix the issue, we need to validate the raw_data_path to ensure it is within a safe root directory and does not allow directory traversal. This can be achieved by:

1. Defining a safe root directory for raw_data_path.
2. Normalizing the user-provided path using os.path.normpath or Path.resolve to eliminate any .. segments.
3. Verifying that the normalized path starts with the safe root directory.

The changes will be made in the validate_input method of the ImportDataset class in cli/medperf/commands/dataset/import_dataset.py. Additionally, we will update the import_dataset function in cli/medperf/web_ui/datasets/routes.py to define a safe root directory for raw_data_path.

---

To fix the issue, we need to validate the raw_data_path to ensure it is safe to use. This involves:

1. Normalizing the path using os.path.normpath or Path.resolve to remove any .. segments or symbolic links.
2. Ensuring the normalized path is contained within a predefined safe root directory (e.g., a specific directory for raw data).
3. Raising an exception if the path is invalid or outside the allowed directory.

The changes will be made in the validate_input method of the ImportDataset class in cli/medperf/commands/dataset/import_dataset.py.

---

[mhmdk0]

Notes:
Should we do some modifications like:

• Change notifications to job lists (running, finished, etc..)
• Changes in tooltips and placeholders to match medperf --help (Place the text in separate file).
• Refactor CSS as needed
• model comp. test running multiple times causes an error (found existing predictions)
• Notifications/Finished tasks logs (last 10 maybe) to be saved in database