UA 2779 | [django-oidc-provider] should address security warnings (#8)

* it builds, tests pass, and I removed a couple bandit warnings of the Severity: High Confidence: High variety

* formatting fix in settings

* added the orm back into the version string in a PEP 440 compliant way.

* Implemented suggestions from the PR. Tests still pass

Author: kdallege

docs/conf.py

@@ -62,7 +62,7 @@
 #
 # This is also used if you do content translation via gettext catalogs.
 # Usually you set "language" from the command line for these cases.
-language = None
+language = 'en'
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:

example/app/settings.py

@@ -2,6 +2,7 @@
 import os
 BASE_DIR = os.path.dirname(os.path.dirname(__file__))
 
+DEFAULT_AUTO_FIELD = 'django.db.models.AutoField' 
 
 SECRET_KEY = 'c14d549c574e4d8cf162404ef0b04598'
 

example/app/urls.py

@@ -1,16 +1,13 @@
 from django.contrib.auth import views as auth_views
-try:
-    from django.urls import include, url
-except ImportError:
-    from django.conf.urls import include, url
+from django.urls import include, re_path
 from django.contrib import admin
 from django.views.generic import TemplateView
 
 
 urlpatterns = [
-    url(r'^$', TemplateView.as_view(template_name='home.html'), name='home'),
-    url(r'^accounts/login/$', auth_views.login, {'template_name': 'login.html'}, name='login'),
-    url(r'^accounts/logout/$', auth_views.logout, {'next_page': '/'}, name='logout'),
-    url(r'^', include('oidc_provider.urls', namespace='oidc_provider')),
-    url(r'^admin/', admin.site.urls),
+    re_path(r'^$', TemplateView.as_view(template_name='home.html'), name='home'),
+    re_path(r'^accounts/login/$', auth_views.LoginView.as_view(template_name='login.html'), name='login'),
+    re_path(r'^accounts/logout/$', auth_views.LogoutView.as_view(next_page='/'), name='logout'),
+    re_path(r'^', include('oidc_provider.urls', namespace='oidc_provider')),
+    re_path(r'^admin/', admin.site.urls),
 ]

example/requirements.txt

@@ -1,2 +1,2 @@
-django
-https://github.com/juanifioren/django-oidc-provider/archive/master.zip
+django==3.2.18
+../

oidc_provider/__init__.py

@@ -1,2 +0,0 @@
-
-default_app_config = 'oidc_provider.apps.OIDCProviderConfig'

oidc_provider/lib/endpoints/authorize.py

@@ -9,7 +9,7 @@
     from urlparse import urlsplit, parse_qs, urlunsplit
 except ImportError:
     from urllib.parse import urlsplit, parse_qs, urlunsplit, urlencode
-from uuid import uuid4
+from secrets import token_hex 
 
 from django.utils import timezone
 
@@ -206,7 +206,7 @@ def create_response_uri(self):
                     redirect_uri_parsed.scheme, redirect_uri_parsed.netloc)
 
                 # Create random salt.
-                salt = md5(uuid4().hex.encode()).hexdigest()
+                salt = token_hex()
 
                 # The generation of suitable Session State values is based
                 # on a salted cryptographic hash of Client ID, origin URL,

oidc_provider/models.py

@@ -264,4 +264,4 @@ def __unicode__(self):
 
     @property
     def kid(self):
-        return u'{0}'.format(md5(self.key.encode('utf-8')).hexdigest() if self.key else '')
+        return u'{0}'.format(md5(self.key.encode('utf-8'), usedforsecurity=False).hexdigest() if self.key else '')

oidc_provider/tests/app/urls.py

@@ -1,18 +1,15 @@
 from django.contrib.auth import views as auth_views
-try:
-    from django.urls import include, url
-except ImportError:
-    from django.conf.urls import include, url
+from django.urls import re_path, include
 from django.contrib import admin
 from django.views.generic import TemplateView
 
 
 urlpatterns = [
-    url(r'^$', TemplateView.as_view(template_name='home.html'), name='home'),
-    url(r'^accounts/login/$',
+    re_path(r'^$', TemplateView.as_view(template_name='home.html'), name='home'),
+    re_path(r'^accounts/login/$',
         auth_views.LoginView.as_view(template_name='accounts/login.html'), name='login'),
-    url(r'^accounts/logout/$',
+    re_path(r'^accounts/logout/$',
         auth_views.LogoutView.as_view(template_name='accounts/logout.html'), name='logout'),
-    url(r'^openid/', include('oidc_provider.urls', namespace='oidc_provider')),
-    url(r'^admin/', admin.site.urls),
+    re_path(r'^openid/', include('oidc_provider.urls', namespace='oidc_provider')),
+    re_path(r'^admin/', admin.site.urls),
 ]

oidc_provider/tests/cases/test_authorize_endpoint.py

@@ -276,20 +276,18 @@ def test_response_uri_is_properly_constructed(self):
         parsed = urlsplit(response['Location'])
         params = parse_qs(parsed.query or parsed.fragment)
         state = params['state'][0]
-        self.assertEquals(self.state, state, msg="State returned is invalid or missing")
+        assert self.state == state, "State returned is invalid or missing"
 
         is_code_ok = is_code_valid(url=response['Location'],
                                    user=self.user,
                                    client=self.client)
-        self.assertTrue(is_code_ok, msg='Code returned is invalid or missing')
+        assert is_code_ok, 'Code returned is invalid or missing'
 
-        self.assertEquals(
-            set(params.keys()), {'state', 'code'},
-            msg='More than state or code appended as query params')
+        assert set(params.keys()) == {'state', 'code'}, \
+            'More than state or code appended as query params'
 
-        self.assertTrue(
-            response['Location'].startswith(self.client.default_redirect_uri),
-            msg='Different redirect_uri returned')
+        assert response['Location'].startswith(self.client.default_redirect_uri), \
+            'Different redirect_uri returned'
 
     def test_unknown_redirect_uris_are_rejected(self):
         """
@@ -395,7 +393,7 @@ def test_prompt_login_parameter(self, logout_function):
 
         response = self._auth_request('get', data, is_user_authenticated=True)
         self.assertIn(settings.get('OIDC_LOGIN_URL'), response['Location'])
-        self.assertTrue(logout_function.called_once())
+        logout_function.assert_called_once()
         self.assertNotIn(
             quote('prompt=login'),
             response['Location'],
@@ -662,7 +660,7 @@ def test_public_client_implicit_auto_approval(self):
 
         response = self._auth_request('get', data, is_user_authenticated=True)
         response_text = response.content.decode('utf-8')
-        self.assertEquals(response_text, '')
+        assert response_text == ''
         components = urlsplit(response['Location'])
         fragment = parse_qs(components[4])
         self.assertIn('access_token', fragment)

oidc_provider/tests/cases/test_claims.py

@@ -1,7 +1,6 @@
 from __future__ import unicode_literals
 
 from django.test import TestCase
-from django.utils.six import text_type
 from django.utils.translation import override as override_language
 
 from oidc_provider.lib.claims import ScopeClaims, StandardScopeClaims, STANDARD_CLAIMS
@@ -49,19 +48,16 @@ def test_clean_dic(self):
             'phone_number': '',
         }
         clean_dict = self.scopeClaims._clean_dic(dict_to_clean)
-        self.assertEquals(
-            clean_dict,
-            {
-                'family_name': 'Doe',
-                'given_name': 'John',
-                'name': 'John Doe',
-                'email': u'[email protected]'
-            }
-        )
+        assert clean_dict == {
+            'family_name': 'Doe',
+            'given_name': 'John',
+            'name': 'John Doe',
+            'email': u'[email protected]',
+        }
 
     def test_locale(self):
         with override_language('fr'):
-            self.assertEqual(text_type(StandardScopeClaims.info_profile[0]), 'Profil de base')
+            assert str(StandardScopeClaims.info_profile[0]) == 'Profil de base'
 
     def test_scopeclaims_class_inheritance(self):
         # Generate example class that will be used for `OIDC_EXTRA_SCOPE_CLAIMS` setting.