Package: victims-web
The victims web application.Report an IssueIf you find an issue with the service athttp://victi.msor the code,
eitherCreate a new issue athttps://github.com/victims/victims-web/issuesEmailvicitms@librelist.comContributingIf you have a patch or a feature that you want considered to be added
to the project, feel free to send us a pull request.Make sure you run pep8 before committing.pep8--repeat.Using PyPI PackageYou can install and use the server by installing thePyPI Packageand
use the provided entrypoint. Do ensure that the required database services
are available and/or configured.pipinstall--uservictims-webvictims-web-serverDevelopmentThis is short guide on how to work on this code base using the provideddocker-composeconfiguration and developmentDockerfile.Notethat theDockerfileprovided in the base directory is not to be used
in production and is only for development use.Docker buildsBuilding the imageThe image can be built to provide a working environment with all
dependencies installed.dockerbuild-tlocal/victims-web.Using the docker imageThe docker image built as shown above will not contain the application
source code but it expects the working directory to be mounted at/opt/source.dockerrun--rm-it-v`pwd`:/opt/sourcelocal/victims-webDocker ComposeThedocker-compose.ymlfile defines services required to run a
working copy of the server on your local machine. Starting the server
viadocker-composewill;start a supported version of MongoDB instanceseed the database with test datastart the web server usingpython-mvictims.webbind to port 5000 on your localhostStarting a serverThis will start an instance of the server as described above. Note that
this is started with bothDEBUGandTESTINGenabled. This will
also ensure that your code is auto re-loaded if changed.docker-composeupserverExecuting tests against your working copyIn order to execute tests against your working copy of code, you may use
thetestservice as described in thedocker-compose.ymlfile.
This will start up dependant services, load seed data and then execute
application tests andpep8.docker-composeuptestUsageSecured API AccessSubmission endpoints like/service/submit/archive/javaare secured
by an implementation similar to what is used by AWS. The authentication
token is expected in a HTTP header configured via theVICTIMS_API_HEADERconfiguration (default:X-Victims-Api). If
this is not present or if validation/authentication fails, then it falls
back toBASIC AUTH.An example using curl is as follows:$curl-v-XPUT-H"X-Victims-Api:$APIKEY:$SIGNATURE"-H"Date: Thu, 22 Aug 2013 15:20:37 GMT"-Farchive=@$ARCHIVEhttps://$VICTIMS_SERVER/service/submit/archive/java?version=VID\&groupId=GID\&artifactId=AID\&cves=CVE-2013-0000,CVE-2013-0001This can also be done usingBASIC-AUTHas follows:curl-v-u$USERNAME:$PASSWORD-XPUT-Farchive=@$ARCHIVE_FILEhttps://$VICTIMS_SERVER/service/submit/archive/java?version=VID\&groupId=GID\&artifactId=AID\&cves=CVE-2013-0000,CVE-2013-0001API Key and Client Secret KeyEach account on victi.ms is allocated an API Key and Secret key by
default. This can be retrieved by visitinghttps://victi.ms/account.
These can be regenerated using the form athttps://victi.ms/account_edit.SignatureThe signature is generated usingHTTP Method,Path,Dateand
theMD5 hexdigest.Notes:ThePathincludes the query string parameters, e.g:/service/submit/archive/java?cves=CVE-0000-0000The MD5 checksum includes the data (if available) of all files that
are being submitted. The checksums are sorted in ascending order
before adding to the string.The date is expected to be inGMT. Eg:Thu, 22 Aug 2013 15:20:37 GMT.The following is a reference implementation in python:fromhmacimportHMACdefgenerate_signature(secret,method,path,date,md5sums):md5sums.sort()ordered=[method,path,date]+md5sumsstring=''forcontentinordered:ifcontentisNone:raiseValueError('Required header not found')string+=str(content)returnHMAC(key=bytes(secret),msg=string.lower(),digestmod=sha512).hexdigest().upper()