Repository: freedomofpress/securedrop

Issue:
Upgrade to flask 2.0.3
*This is a good first issue for new contributors to take on, if you have any questions, please ask on the task or in our [Gitter room](https://gitter.im/freedomofpress/securedrop)!*

## Description

We currently have some type checking disabled because of a bug in flask 2.0.2 that was fixed in 2.0.3. We don't want to upgrade to 2.1.0+ yet since that's a much bigger step.

```
    # TODO: enable type checking once upstream Flask fix is available. See:
    # https://github.com/pallets/flask/issues/4295
    @app.errorhandler(CSRFError)  # type: ignore
    def handle_csrf_error(e: CSRFError) -> "Response":
```

## How to fix

You'll want to update the dependency in `securedrop-app-code-requirements.in`, probably `Flask>=2.0.3,<2.1.0`, run `make update-python3-requirements` to build the new `securedrop-app-code-requirements.txt`.

Then disable the mypy overrides (and ensure mypy passes) and test basic submission functionality using the dev container.

Note that for dependency updates we require a "[diff review](https://github.com/freedomofpress/securedrop/wiki/Dependency-specification-and-update-policies)" to be done. This will be done by a SecureDrop maintainer after you submit a PR.


Discussion:
Hi @legoktm, can I work on this?
> Hi @legoktm, can I work on this?

Feel free! let us know if you have any questions.
@zenmonkeykstop , @legoktm I referred [this document](https://developers.securedrop.org/en/latest/setup_development.html) but I am not entirely sure how to setup the development environment since I am using windows. Can you please guide me? 
Unfortunately we don't have a lot of guidance for using Windows, do you have the Windows Subsystem for Linux (WSL) set up? You'll also need to install Docker.
Sorry, I can't help with this issue.
Hi @legoktm! Could I work on this issue?

Resolving patch:
diff --git a/securedrop/journalist_app/__init__.py b/securedrop/journalist_app/__init__.py
--- a/securedrop/journalist_app/__init__.py
+++ b/securedrop/journalist_app/__init__.py
@@ -78,9 +78,7 @@ def default(self, obj: "Any") -> "Any":
 
     app.json_encoder = JSONEncoder
 
-    # TODO: enable type checking once upstream Flask fix is available. See:
-    # https://github.com/pallets/flask/issues/4295
-    @app.errorhandler(CSRFError)  # type: ignore
+    @app.errorhandler(CSRFError)
     def handle_csrf_error(e: CSRFError) -> "Response":
         app.logger.error("The CSRF token is invalid.")
         msg = gettext("You have been logged out due to inactivity.")
diff --git a/securedrop/source_app/__init__.py b/securedrop/source_app/__init__.py
--- a/securedrop/source_app/__init__.py
+++ b/securedrop/source_app/__init__.py
@@ -62,9 +62,7 @@ def setup_i18n() -> None:
     app.config["SQLALCHEMY_DATABASE_URI"] = config.DATABASE_URI
     db.init_app(app)
 
-    # TODO: enable typechecking once upstream Flask fix is available. See:
-    # https://github.com/pallets/flask/issues/4295
-    @app.errorhandler(CSRFError)  # type: ignore
+    @app.errorhandler(CSRFError)
     def handle_csrf_error(e: CSRFError) -> werkzeug.Response:
         return clear_session_and_redirect_to_logged_out_page(flask_session=session)
 


Test patch: