FSPT-1514 Access tasklist all questions

[sfount]

🎫 Ticket

https://mhclgdigital.atlassian.net/browse/FSPT-1514

📝 Description

This implements the all questions page on the Access grant funding
tasklist.

This mirrors what has been added to the admin pages - and should only be merged after initial team consensus on that functionality across different real collections.

📸 Show the thing (screenshots, gifs)

🧪 Testing

Load up any collection in access.

📋 Developer Checklist

Review Readiness

• PR title and description provide sufficient context for reviewers
• Commits are logical, self-contained, and have clear descriptions

Performance and security

• No N+1 query problems introduced
• Any new DB queries include appropriate where clauses based on the user's permissions

Testing

• I have tested this change and it meets the acceptance criteria for the ticket
• I need the reviewer(s) to pull and run this change locally
• New (non-developer) functionality has appropriate unit and integration tests
• End-to-end tests have been updated (if applicable)
• Edge cases and error conditions are tested

[wiz-72cad32f19]

 SAST Finding

Potential Path Traversal Vulnerability in Flask (CWE-22)

More Details

This rule detects a potential path traversal vulnerability in Flask applications. Path traversal vulnerabilities occur when user-controlled data is used directly in file system operations without proper sanitization. This could allow an attacker to access or manipulate arbitrary files on the server's file system, potentially leading to data breaches, code execution, or system compromise.

The vulnerability arises when user input from Flask request parameters (such as request.args, request.form, request.values, request.json, or request.data) is used directly in file operations like open() or pathlib.Path() without validating or sanitizing the input. An attacker could craft malicious input containing directory traversal sequences (e.g., '../') to access files outside the intended directory.

To mitigate this risk, user input should never be trusted and must be properly validated and sanitized before using it in file system operations. Implement input validation checks, remove or replace directory traversal sequences, and restrict file access to a whitelisted directory.

Attribute	Value
Impact
Likelihood

Remediation

Path traversal vulnerabilities allow an attacker to access or manipulate files outside of the intended directory on the server's file system. This can lead to unauthorized data access, data tampering, or even remote code execution, posing a severe security risk.

To mitigate this vulnerability, user-supplied input should never be directly used in file operations without proper sanitization. Instead, implement strict input validation and path canonicalization to prevent path traversal attacks. Sanitize user input by removing or encoding special characters like "../" that could be used for directory traversal. Additionally, use secure APIs that provide path normalization and restrict access to sensitive directories.

Code examples

# VULNERABLE CODE - User input is directly used in file operations without sanitization
file_path = request.args.get('file')
with open(file_path, 'r') as f:
    contents = f.read()

# SECURE CODE - User input is sanitized, and path is normalized using secure APIs
import os
from pathlib import Path

file_name = request.args.get('file')
# Sanitize user input
file_name = os.path.basename(file_name)
# Normalize path and restrict access to the 'files' directory
file_path = Path('files', file_name).resolve()
if not file_path.is_file() or not file_path.parent == Path('files'):
    raise ValueError('Invalid file path')
with file_path.open('r') as f:
    contents = f.read()

Additional recommendations

• Follow the principle of least privilege and restrict file access permissions as much as possible.
• Implement strict input validation using allowlists (whitelists) instead of denylists (blacklists).
• Consider using web application firewalls (WAFs) or content security policies (CSPs) as additional layers of defense.
• Adhere to the OWASP Top 10 Web Application Security Risks and the OWASP Cheat Sheet Series for secure coding practices.
• Regularly update your dependencies and frameworks to ensure you have the latest security patches.

Rule ID: WS-PYTHON-00326

To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason

If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).

To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate

[Tudor-MHCLG]

yarr