remote 404 body
" + response = httpx.Response( + 404, + request=httpx.Request("GET", "https://provider.example/v1/models"), + ) + + with patch("tasks.jobs.lighthouse_providers.openai.OpenAI") as mock_openai: + mock_client = MagicMock() + mock_client.models.list.side_effect = openai.NotFoundError( + remote_body, + response=response, + body=remote_body, + ) + mock_openai.return_value = mock_client + + eager_result = check_lighthouse_provider_connection_task.apply( + kwargs={ + "provider_config_id": str(provider_cfg.id), + "tenant_id": str(tenants_fixture[0].id), + } + ) + + assert eager_result.successful() + result = eager_result.result + assert result == {"connected": False, "error": "Provider connection failed"} + assert remote_body not in result["error"] + provider_cfg.refresh_from_db() + assert provider_cfg.is_active is False + + def test_openai_compatible_connection_masks_remote_auth_error( + self, tenants_fixture + ): + provider_cfg = LighthouseProviderConfiguration( + tenant_id=tenants_fixture[0].id, + provider_type=LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE, + base_url="https://93.184.216.34/api/v1", + is_active=True, + ) + provider_cfg.credentials_decoded = {"api_key": "compatible-key"} + provider_cfg.save() + remote_body = {"error": {"message": "remote auth detail"}} + response = httpx.Response( + 401, + request=httpx.Request("GET", "https://provider.example/v1/models"), + ) + + with patch("tasks.jobs.lighthouse_providers.openai.OpenAI") as mock_openai: + mock_client = MagicMock() + mock_client.models.list.side_effect = openai.AuthenticationError( + "Unauthorized", + response=response, + body=remote_body, + ) + mock_openai.return_value = mock_client + + eager_result = check_lighthouse_provider_connection_task.apply( + kwargs={ + "provider_config_id": str(provider_cfg.id), + "tenant_id": str(tenants_fixture[0].id), + } + ) + + assert eager_result.successful() + result = eager_result.result + assert result == {"connected": False, "error": "API key is invalid or missing"} + assert "remote auth detail" not in result["error"] + provider_cfg.refresh_from_db() + assert provider_cfg.is_active is False + + def test_openai_compatible_network_backend_uses_validated_ip(self, monkeypatch): + backend = _LighthouseOpenAICompatibleNetworkBackend() + stream = MagicMock() + + def resolve_to_public_ip(host, port): + del host, port + return ("93.184.216.34",) + + monkeypatch.setattr( + "tasks.jobs.lighthouse_providers.resolve_lighthouse_openai_compatible_host", + resolve_to_public_ip, + ) + + with patch( + "tasks.jobs.lighthouse_providers.httpcore.SyncBackend.connect_tcp", + return_value=stream, + ) as mock_connect_tcp: + result = backend.connect_tcp("provider.example", 443, timeout=1.0) + + assert result is stream + assert mock_connect_tcp.call_args.args[:2] == ("93.184.216.34", 443) + assert mock_connect_tcp.call_args.kwargs["timeout"] == 1.0 + def test_check_connection_provider_does_not_exist(self, tenants_fixture): """Test that checking non-existent provider raises DoesNotExist.""" non_existent_id = str(uuid.uuid4()) @@ -1784,7 +1946,7 @@ class TestRefreshLighthouseProviderModelsTask: ( LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE, {"api_key": "sk-test123"}, - "https://openrouter.ai/api/v1", + "https://93.184.216.34/api/v1", {"model-1": "Model One", "model-2": "Model Two"}, 2, ), @@ -1864,6 +2026,106 @@ class TestRefreshLighthouseProviderModelsTask: == expected_count ) + def test_refresh_models_rejects_metadata_base_url_without_request( + self, tenants_fixture + ): + provider_cfg = LighthouseProviderConfiguration( + tenant_id=tenants_fixture[0].id, + provider_type=LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE, + base_url="https://169.254.169.254/latest/meta-data", + is_active=True, + ) + provider_cfg.credentials_decoded = {"api_key": "compatible-key"} + provider_cfg.save() + + with patch( + "tasks.jobs.lighthouse_providers._fetch_openai_compatible_models" + ) as mock_fetch: + eager_result = refresh_lighthouse_provider_models_task.apply( + kwargs={ + "provider_config_id": str(provider_cfg.id), + "tenant_id": str(tenants_fixture[0].id), + } + ) + + assert eager_result.successful() + result = eager_result.result + assert result["created"] == 0 + assert result["updated"] == 0 + assert result["deleted"] == 0 + assert "base url" in result["error"].lower() + mock_fetch.assert_not_called() + + def test_refresh_models_disables_redirects(self, tenants_fixture): + provider_cfg = LighthouseProviderConfiguration( + tenant_id=tenants_fixture[0].id, + provider_type=LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE, + base_url="https://93.184.216.34/api/v1", + is_active=True, + ) + provider_cfg.credentials_decoded = {"api_key": "compatible-key"} + provider_cfg.save() + + with patch("tasks.jobs.lighthouse_providers.openai.OpenAI") as mock_openai: + mock_client = MagicMock() + mock_client.models.list.return_value = MagicMock(data=[]) + mock_openai.return_value = mock_client + + eager_result = refresh_lighthouse_provider_models_task.apply( + kwargs={ + "provider_config_id": str(provider_cfg.id), + "tenant_id": str(tenants_fixture[0].id), + } + ) + + assert eager_result.successful() + result = eager_result.result + assert result["created"] == 0 + assert result["updated"] == 0 + assert result["deleted"] == 0 + http_client = mock_openai.call_args.kwargs["http_client"] + assert http_client.follow_redirects is False + assert http_client.trust_env is False + + def test_refresh_models_masks_remote_http_error(self, tenants_fixture): + provider_cfg = LighthouseProviderConfiguration( + tenant_id=tenants_fixture[0].id, + provider_type=LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE, + base_url="https://93.184.216.34/api/v1", + is_active=True, + ) + provider_cfg.credentials_decoded = {"api_key": "compatible-key"} + provider_cfg.save() + remote_body = "remote 404 body
" + response = httpx.Response( + 404, + request=httpx.Request("GET", "https://provider.example/v1/models"), + ) + + with patch("tasks.jobs.lighthouse_providers.openai.OpenAI") as mock_openai: + mock_client = MagicMock() + mock_client.models.list.side_effect = openai.NotFoundError( + remote_body, + response=response, + body=remote_body, + ) + mock_openai.return_value = mock_client + + eager_result = refresh_lighthouse_provider_models_task.apply( + kwargs={ + "provider_config_id": str(provider_cfg.id), + "tenant_id": str(tenants_fixture[0].id), + } + ) + + assert eager_result.successful() + result = eager_result.result + assert result["created"] == 0 + assert result["updated"] == 0 + assert result["deleted"] == 0 + assert result["error"] == "Provider connection failed" + assert remote_body not in result["error"] + def test_refresh_models_mixed_operations(self, tenants_fixture): """Test mixed create, update, and delete operations.""" # Create provider configuration diff --git a/contrib/k8s/helm/prowler-app/templates/api/configmap.yaml b/contrib/k8s/helm/prowler-app/templates/api/configmap.yaml index 8e219a9271..a76982d403 100644 --- a/contrib/k8s/helm/prowler-app/templates/api/configmap.yaml +++ b/contrib/k8s/helm/prowler-app/templates/api/configmap.yaml @@ -7,4 +7,4 @@ metadata: data: {{- range $key, $value := .Values.api.djangoConfig }} {{ $key }}: {{ $value | quote }} - {{- end }} \ No newline at end of file + {{- end }} diff --git a/contrib/k8s/helm/prowler-app/templates/api/role.yaml b/contrib/k8s/helm/prowler-app/templates/api/role.yaml index 172b035076..f55d3c7dc9 100644 --- a/contrib/k8s/helm/prowler-app/templates/api/role.yaml +++ b/contrib/k8s/helm/prowler-app/templates/api/role.yaml @@ -26,4 +26,4 @@ roleRef: subjects: - kind: ServiceAccount name: {{ include "prowler.api.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} \ No newline at end of file + namespace: {{ .Release.Namespace }} diff --git a/docs/user-guide/providers/azure/authentication.mdx b/docs/user-guide/providers/azure/authentication.mdx index 852e79d115..08bc79d8ff 100644 --- a/docs/user-guide/providers/azure/authentication.mdx +++ b/docs/user-guide/providers/azure/authentication.mdx @@ -210,7 +210,9 @@ For more detailed guidance on subscription management and permissions: The following security checks require the `ProwlerRole` permissions for execution. Ensure the role is assigned to the identity assumed by Prowler before running these checks: - `app_function_access_keys_configured` +- `app_function_application_insights_enabled` - `app_function_ftps_deployment_disabled` +- `app_function_latest_runtime_version` --- diff --git a/docs/user-guide/tutorials/prowler-app-lighthouse-multi-llm.mdx b/docs/user-guide/tutorials/prowler-app-lighthouse-multi-llm.mdx index cdc6e84b9a..b1cb918de7 100644 --- a/docs/user-guide/tutorials/prowler-app-lighthouse-multi-llm.mdx +++ b/docs/user-guide/tutorials/prowler-app-lighthouse-multi-llm.mdx @@ -128,6 +128,25 @@ To connect a provider: 3. Configure in Lighthouse AI: - **API Key**: OpenRouter API key - **Base URL**: `https://openrouter.ai/api/v1` + + ### Base URL Validation + + To prevent server-side request forgery (SSRF), Prowler API validates the base URL before connecting to it: + + - The URL must use HTTPS. + - The host must resolve to a public IP address. Private, loopback, link-local, and cloud metadata addresses are rejected. + ++ {attrs.providers.length} of {compatibleTypes.length}{" "} + compatible providers scanned · {attrs.scan_ids.length}{" "} + {attrs.scan_ids.length === 1 ? "scan" : "scans"} aggregated +
++ No provider scan contributed to this requirement with the current + filters. +
+ ); + } + + const scanIds = Array.from( + new Set( + contributingTypes.flatMap((type) => extras.scanIdsByProvider[type] ?? []), + ), + ); + + return ( ++ No scanned providers for this framework yet. +
+ )} + {scannedProviders.map((entry) => ( ++ No per-provider breakdown is available for this requirement. +
+ ), + items: [], + }; + }), + ), + })), + ); diff --git a/ui/app/(prowler)/compliance/_lib/cross-provider-adapter.ts b/ui/app/(prowler)/compliance/_lib/cross-provider-adapter.ts new file mode 100644 index 0000000000..9a15fa2f99 --- /dev/null +++ b/ui/app/(prowler)/compliance/_lib/cross-provider-adapter.ts @@ -0,0 +1,168 @@ +import type { + AttributesData, + AttributesItemData, + CheckProviderTypesMap, + RequirementItemData, + RequirementsData, +} from "@/types/compliance"; +import { isKnownProviderType, PROVIDER_TYPES } from "@/types/providers"; + +import type { + CrossProviderOverviewAttributes, + CrossProviderRequirementExtras, + ProviderBreakdownEntry, + ProviderCheckIdsMap, +} from "../_types"; + +/** The composed display name the per-scan mappers give every requirement. + * Shared with `buildRequirementExtrasMap` so the extras join never parses + * strings back apart. */ +const composeRequirementName = (id: string, name: string): string => + name ? `${id} - ${name}` : id; + +/** + * Convert a cross-provider overview into the `{AttributesData, + * RequirementsData}` pair the per-scan compliance mappers consume, so the + * existing framework mappers (grouping, counters, detail fields) render the + * requirements accordion without a parallel cross-provider pipeline. + * + * The mappers read `attributes.attributes.metadata[0]` for framework-specific + * fields (Section, Pillar, …), so each requirement's flat `attributes` dict is + * wrapped in a single-element array. `check_ids` is the deduped union across + * providers — per-provider splits travel separately via + * {@link buildRequirementExtrasMap}. + */ +export const crossProviderToMapperInput = ( + attrs: CrossProviderOverviewAttributes, +): { attributesData: AttributesData; requirementsData: RequirementsData } => { + const attributeItems: AttributesItemData[] = []; + const requirementItems: RequirementItemData[] = []; + + for (const requirement of attrs.requirements) { + const allCheckIds = Array.from( + new Set( + Object.values(requirement.check_ids_by_provider ?? {}).flatMap( + (ids) => ids ?? [], + ), + ), + ); + + attributeItems.push({ + type: "compliance-requirements-attributes", + id: requirement.id, + attributes: { + framework_description: attrs.description || "", + name: requirement.name, + framework: attrs.framework, + version: attrs.version || "", + description: requirement.description || "", + attributes: { + metadata: [ + requirement.attributes, + ] as AttributesItemData["attributes"]["attributes"]["metadata"], + check_ids: allCheckIds, + }, + }, + }); + + requirementItems.push({ + type: "compliance-requirements-details", + id: requirement.id, + attributes: { + framework: attrs.framework, + version: attrs.version || "", + description: requirement.description || "", + status: requirement.status, + }, + }); + } + + return { + attributesData: { data: attributeItems }, + requirementsData: { data: requirementItems }, + }; +}; + +/** + * Cross-provider context for each requirement, keyed by the exact composed + * name the mappers produce, so renderers can join per-provider statuses and + * scan/check splits onto mapped requirements without touching the mappers. + */ +export const buildRequirementExtrasMap = ( + attrs: CrossProviderOverviewAttributes, +): Map