Repository: rstudio/fuzzbucket (language: python)

Issue:
The default CIDR block is not private address space
The default VPC cidr block of 172.98.0.0/18 is not actually private.
The 172 space that is private is 172.16.0.0/12, which is 172.16.0.0 – 172.31.255.255
See https://en.wikipedia.org/wiki/Private_network

GuardDuty actually triggered a finding due to it thinking that the ASN of the IP address was unusual, which consumed a number of folks time to track down the cause.


Discussion / hints:

Fix patch:
diff --git a/default-resources.yml b/default-resources.yml
index 8e0a606..9a8b443 100644
--- a/default-resources.yml
+++ b/default-resources.yml
@@ -3,7 +3,7 @@ resources:
     VPC:
       Type: AWS::EC2::VPC
       Properties:
-        CidrBlock: 172.98.0.0/18
+        CidrBlock: 172.22.0.0/20
         EnableDnsSupport: true
         EnableDnsHostnames: true
         Tags:
@@ -15,7 +15,7 @@ resources:
       Properties:
         VpcId: !Ref VPC
         AvailabilityZone: ${aws:region, 'us-east-1'}a
-        CidrBlock: 172.98.0.0/18
+        CidrBlock: 172.22.0.0/20
         MapPublicIpOnLaunch: true
         Tags:
         - Key: Name
diff --git a/fuzzbucket/__init__.py b/fuzzbucket/__init__.py
index a99773c..3f6e44e 100644
--- a/fuzzbucket/__init__.py
+++ b/fuzzbucket/__init__.py
@@ -8,7 +8,7 @@
 
 def deferred_app(
     environ: dict[str, str], start_response: typing.Callable
-) -> typing.Iterable[str]:
+) -> typing.Iterable[bytes]:
     return cached_app()(environ, start_response)
 
 
diff --git a/fuzzbucket/g.py b/fuzzbucket/g.py
index 5e23315..622f1d1 100644
--- a/fuzzbucket/g.py
+++ b/fuzzbucket/g.py
@@ -7,10 +7,10 @@
     flask_dance.consumer.OAuth2ConsumerBlueprint
 ] = werkzeug.local.LocalProxy(auth.get_oauth_blueprint)
 
-oauth_session: werkzeug.local.LocalProxy[
-    flask_dance.consumer.OAuth2Session
-] = werkzeug.local.LocalProxy(lambda: auth.get_oauth_blueprint().session)
+oauth_session: werkzeug.local.LocalProxy[flask_dance.consumer.OAuth2Session] = (
+    werkzeug.local.LocalProxy(lambda: auth.get_oauth_blueprint().session)
+)
 
-user_storage: werkzeug.local.LocalProxy[
-    flask_dance_storage.FlaskDanceStorage
-] = werkzeug.local.LocalProxy(flask_dance_storage.get_storage)
+user_storage: werkzeug.local.LocalProxy[flask_dance_storage.FlaskDanceStorage] = (
+    werkzeug.local.LocalProxy(flask_dance_storage.get_storage)
+)
diff --git a/fuzzbucket_client/__main__.py b/fuzzbucket_client/__main__.py
index 16d94ff..2c126fe 100644
--- a/fuzzbucket_client/__main__.py
+++ b/fuzzbucket_client/__main__.py
@@ -141,8 +141,7 @@ def utcnow() -> datetime.datetime:
 
 class CustomHelpFormatter(
     argparse.ArgumentDefaultsHelpFormatter, argparse.RawDescriptionHelpFormatter
-):
-    ...
+): ...
 
 
 def main(sysargs: list[str] = sys.argv[:]) -> int:
diff --git a/pyproject.toml b/pyproject.toml
index 74046ca..ae3aecd 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -123,6 +123,8 @@ addopts = '''
   --cov-report term
   --cov-report html
   --cov-report xml
+  --ignore=wsgi_handler.py
+  --ignore=serverless_wsgi.py
   -vv
   --mypy
   --disable-warnings


Test patch:
diff --git a/conftest.py b/conftest.py
index cb91659..d89699b 100644
--- a/conftest.py
+++ b/conftest.py
@@ -73,7 +73,7 @@ def env_setup():
 def dynamodb(fake_users, monkeypatch):
     from fuzzbucket import aws
 
-    with moto.mock_dynamodb():
+    with moto.mock_aws():
         ddb = boto3.resource("dynamodb", region_name="us-east-1")
         setup_dynamodb_tables(ddb, fake_users)
 
@@ -87,7 +87,7 @@ def dynamodb(fake_users, monkeypatch):
 def ec2(monkeypatch):
     from fuzzbucket import aws
 
-    with moto.mock_ec2():
+    with moto.mock_aws():
         ec2c = boto3.client("ec2", region_name="us-east-1")
 
         with monkeypatch.context() as mp: