owasp top 10 security and performance tests added

Author: COT-WORLD

app/oauth2.py

@@ -44,4 +44,9 @@ async def get_current_user(db: SessionDep, token: str = Depends(oauth2_scheme)):
     token = verify_access_token(token)
     user = db.exec(select(User).filter(
         User.id == token.id)).first()
+    if not user:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="User not found"
+        )
     return user

app/routers/post.py

@@ -6,6 +6,7 @@
 from app.models import Post, Vote
 from app.schemas import PostCreateUpdate, PostSchema, PostOut
 from sqlalchemy import func
+from app.utils import sanitize_input
 
 router = APIRouter(prefix="/posts", tags=["Post"])
 
@@ -37,6 +38,8 @@ async def create_post(
     db: SessionDep,
     current_user=Depends(oauth2.get_current_user),
 ):
+    post_data.title = sanitize_input(post_data.title)
+    post_data.content = sanitize_input(post_data.content)
     new_post = Post(owner_id=current_user.id, **post_data.model_dump())
     db.add(new_post)
     db.commit()
@@ -58,7 +61,7 @@ async def get_post(
     if not post:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
-            detail=f"post with id: {id} doesn't exist",
+            detail=f"post with id: {id} was not exist",
         )
     return post
 
@@ -75,14 +78,17 @@ async def update_post(
     if not existing_post:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
-            detail=f"post with id: {id} doesn't found",
+            detail=f"post with id: {id} was not found",
         )
     if existing_post.owner_id != current_user.id:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Not authorised to perform requsted action",
         )
-
+    if post.title:
+        post.title = sanitize_input(post.title)
+    if post.content:
+        post.content = sanitize_input(post.content)
     post_data = post.model_dump(exclude_unset=True)
     existing_post.sqlmodel_update(post_data)
     db.add(existing_post)
@@ -100,7 +106,7 @@ async def delete_post(
     if not deleted_post:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
-            detail=f"post with id: {id} doesn't found",
+            detail=f"post with id: {id} was not found",
         )
     if deleted_post.owner_id != current_user.id:
         raise HTTPException(
@@ -110,4 +116,4 @@ async def delete_post(
 
     db.delete(deleted_post)
     db.commit()
-    return deleted_post
+    return

app/routers/user.py

@@ -5,6 +5,7 @@
 from app.models import User
 from app.schemas import UserBase, UserSchema
 from app.utils import get_password_hash
+from app.utils import sanitize_input
 
 router = APIRouter(
     prefix="/users", tags=["User"]
@@ -19,10 +20,11 @@ async def get_users(db: SessionDep):
 
 @router.post("/", status_code=status.HTTP_201_CREATED, response_model=UserSchema)
 async def create_user(user: UserBase, db: SessionDep):
+    user.email = sanitize_input(user.email)
     user_exist = db.exec(select(User).filter(User.email == user.email)).first()
     if user_exist:
         raise HTTPException(status_code=status.HTTP_406_NOT_ACCEPTABLE,
-                            detail=f"User with email: {user.email} is exist, use diffrent email or login with this email")
+                            detail=f"User with email '{user.email}' already exists. Please use a different email or log in.")
     hashed_password = get_password_hash(user.password)
     user.password = hashed_password
     new_user = User(**user.model_dump())
@@ -37,5 +39,5 @@ async def get_user(id: int, db: SessionDep):
     user = db.get(User, id)
     if not user:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND,
-                            detail=f"User with id: {id} doesn't found")
+                            detail=f"User with id: {id} was not found")
     return user

app/routers/vote.py

@@ -20,7 +20,6 @@ async def create_votes(vote: VoteSchema, db: SessionDep, current_user=Depends(oa
     if not post:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND,
                             detail=f"post with id: {vote.post_id} doesn't exist")
-
     already_voted = db.exec(select(Vote).filter(
         Vote.post_id == vote.post_id, Vote.user_id == current_user.id)).first()
     if vote.dir == 1:
@@ -34,7 +33,7 @@ async def create_votes(vote: VoteSchema, db: SessionDep, current_user=Depends(oa
     else:
         if not already_voted:
             raise HTTPException(status_code=status.HTTP_404_NOT_FOUND,
-                                detail="Vote doesn't found")
+                                detail="Vote not found")
         db.delete(already_voted)
         db.commit()
         return {"message": "Successfully deleted vote"}

app/utils.py

@@ -1,10 +1,17 @@
+import bleach
 from passlib.context import CryptContext
 pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+ALLOWED_TAGS = []
+ALLOWED_ATTRIBUTES = {}
 
 
-def get_password_hash(password: str):
+def get_password_hash(password: str) -> str:
     return pwd_context.hash(password)
 
 
-def verify_password(plain_password, hashed_password):
+def verify_password(plain_password: str, hashed_password: str) -> bool:
     return pwd_context.verify(plain_password, hashed_password)
+
+
+def sanitize_input(text: str) -> str:
+    return bleach.clean(text, tags=ALLOWED_TAGS, attributes=ALLOWED_ATTRIBUTES, strip=True)

requirements.txt

@@ -1,14 +1,21 @@
 alembic==1.15.2
 annotated-types==0.7.0
 anyio==4.9.0
-bcrypt==4.3.0
+Authlib==1.5.2
+bcrypt==4.0.1
+bleach==6.2.0
 certifi==2025.4.26
+cffi==1.17.1
+charset-normalizer==3.4.2
 click==8.1.8
 colorama==0.4.6
+cryptography==44.0.3
 dnspython==2.7.0
+dparse==0.6.4
 email_validator==2.2.0
 fastapi==0.115.12
 fastapi-cli==0.0.7
+filelock==3.16.1
 greenlet==3.2.1
 gunicorn==23.0.0
 h11==0.16.0
@@ -19,36 +26,54 @@ idna==3.10
 iniconfig==2.1.0
 itsdangerous==2.2.0
 Jinja2==3.1.6
+joblib==1.5.0
 Mako==1.3.10
 markdown-it-py==3.0.0
 MarkupSafe==3.0.2
+marshmallow==4.0.0
 mdurl==0.1.2
+nltk==3.9.1
 orjson==3.10.16
 packaging==25.0
 passlib==1.7.4
 pluggy==1.5.0
+psutil==6.1.1
 psycopg2==2.9.10
-pydantic==2.11.3
+pycparser==2.22
+pydantic==2.9.2
 pydantic-extra-types==2.10.3
 pydantic-settings==2.9.1
-pydantic_core==2.33.1
+pydantic_core==2.23.4
 Pygments==2.19.1
 PyJWT==2.10.1
 pytest==8.3.5
 python-dotenv==1.1.0
 python-multipart==0.0.20
 PyYAML==6.0.2
+regex==2024.11.6
+requests==2.32.3
 rich==14.0.0
 rich-toolkit==0.14.3
+ruamel.yaml==0.18.10
+ruamel.yaml.clib==0.2.12
+safety==3.4.0
+safety-schemas==0.0.14
+setuptools==80.3.1
 shellingham==1.5.4
 sniffio==1.3.1
 SQLAlchemy==2.0.40
 sqlmodel==0.0.24
 starlette==0.46.2
+tenacity==9.1.2
+tomlkit==0.13.2
+tqdm==4.67.1
 typer==0.15.2
 typing-inspection==0.4.0
 typing_extensions==4.13.2
 ujson==5.10.0
+urllib3==2.4.0
 uvicorn==0.34.2
 watchfiles==1.0.5
+webencodings==0.5.1
 websockets==15.0.1
+wheel==0.45.1