Skip to content

SECURITY.md #753

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file added .DS_Store
Binary file not shown.
36 changes: 36 additions & 0 deletions .github/workflows/blank.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
# This is a basic workflow to help you get started with Actions

name: CI

# Controls when the workflow will run
on:
# Triggers the workflow on push or pull request events but only for the master branch
push:
branches: [ master ]
pull_request:
branches: [ master ]

# Allows you to run this workflow manually from the Actions tab
workflow_dispatch:

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
# This workflow contains a single job called "build"
build:
# The type of runner that the job will run on
runs-on: ubuntu-latest

# Steps represent a sequence of tasks that will be executed as part of the job
steps:
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
- uses: actions/checkout@v2

# Runs a single command using the runners shell
- name: Run a one-line script
run: echo Hello, world!

# Runs a set of commands using the runners shell
- name: Run a multi-line script
run: |
echo Add other actions to build,
echo test, and deploy your project.
71 changes: 71 additions & 0 deletions .github/workflows/codeql-analysis.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,71 @@
# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: "CodeQL"

on:
push:
branches: [ master ]
pull_request:
# The branches below must be a subset of the branches above
branches: [ master ]
schedule:
- cron: '22 8 * * 0'

jobs:
analyze:
name: Analyze
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write

strategy:
fail-fast: false
matrix:
language: [ 'javascript' ]
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
# Learn more:
# https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed

steps:
- name: Checkout repository
uses: actions/checkout@v2

# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@v1
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
# By default, queries listed here will override any specified in a config file.
# Prefix the list here with "+" to use these queries and those in the config file.
# queries: ./path/to/local/query, your-org/your-repo/queries@main

# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
# If this step fails, then you should remove it and run the build manually (see below)
- name: Autobuild
uses: github/codeql-action/autobuild@v1

# ℹ️ Command-line programs to run using the OS shell.
# 📚 https://git.io/JvXDl

# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
# and modify them (or add more) to build your code if your project
# uses a compiled language

#- run: |
# make bootstrap
# make release

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v1
21 changes: 21 additions & 0 deletions SECURITY.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
# Security Policy

## Supported Versions

Use this section to tell people about which versions of your project are
currently being supported with security updates.

| Version | Supported |
| ------- | ------------------ |
| 5.1.x | :white_check_mark: |
| 5.0.x | :x: |
| 4.0.x | :white_check_mark: |
| < 4.0 | :x: |

## Reporting a Vulnerability

Use this section to tell people how to report a vulnerability.

Tell them where to go, how often they can expect to get an update on a
reported vulnerability, what to expect if the vulnerability is accepted or
declined, etc.
177 changes: 177 additions & 0 deletions app_authKey.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,177 @@
from flask import Flask, request, render_template, jsonify
from io import BytesIO
from captchaModel.model import load_model, inference
# from waitress import serve
import numpy as np
import base64
from PIL import Image
from waitress import serve
from paste.translogger import TransLogger
import time
import math

sess, dectection_graph = load_model()
app = Flask(__name__)

# app.config['SECRET_KEY'] = 'secret key here'
# app.config['HOST'] = '0.0.0.0'
# app.config['DEBUG'] = True
# app.config["CACHE_TYPE"] = "null"

# change to "redis" and restart to cache again

# some time later
# cache.init_app(app)


# @app.route('/')
# def home():
# return "Hello World"

# def shutdown_server():
# func = request.environ.get('werkzeug.server.shutdown')
# if func is None:
# raise RuntimeError('Not running with the Werkzeug Server')
# func()

# @app.route('/shutdown', methods=['POST'])
# def shutdown():
# shutdown_server()
# return 'Server shutting down...'


@app.route('/api/predict/', methods=['GET', 'POST','DELETE', 'PATCH'])
def api_predict():
# print(request.is_json)
# image_base64 = request.form['image']
# image = base64.b64decode(image_base64)
# image = Image.open(BytesIO(image))
# if image.mode != "RGB":
# image.convert("RGB")

# image_arr = np.array(image, dtype=np.uint8)
# # print(image_arr)
# start_date = time.time()
# res = inference(sess, dectection_graph, image_arr)
# end_date = time.time()
# result_date = start_date - end_date
# # print(res)
# return jsonify(answer=res, status=True, captcha=res, time=format(math.floor(result_date)).replace("-","") + "s")
# return {
# "captcha": res,
# "time": format(math.floor(result_date)).replace("-","") + "s"}

# return jsonify(answer=res, status=True)
apiKeys = []
with open('key_api.txt', 'r') as listApiKeys:
apiKeys = [listApiKey.rstrip() for listApiKey in listApiKeys.readlines()]
# print(apiKey)
# apiKey = 'Pong11299'


if request.is_json:
data_json = request.get_json()
if data_json['api_key'] in apiKeys:
print('found')
try:
if data_json:
image_base64 = data_json['image']
image = base64.b64decode(image_base64)
image = Image.open(BytesIO(image))
if image.mode != "RGB":
image.convert("RGB")

image_arr = np.array(image, dtype=np.uint8)
# print(image_arr)
res = inference(sess, dectection_graph, image_arr)

return jsonify(answer=res, status=True)
except Exception as e:
return jsonify(answer="", status=False)
else:
return jsonify(answer="NoApiKey", status=False, text='Please Enter API KEY')
else:
image_base64 = request.form['image']
image = base64.b64decode(image_base64)
image = Image.open(BytesIO(image))
if image.mode != "RGB":
image.convert("RGB")

image_arr = np.array(image, dtype=np.uint8)
# print(image_arr)
start_date = time.time()
res = inference(sess, dectection_graph, image_arr)
end_date = time.time()
result_date = start_date - end_date
# print(res)
return {
"captcha": res,
"time": format(math.floor(result_date)).replace("-","") + "s"}


# base64 = request.form['base64']
# start_date = time.time()
# captcha = Captcha_detection(base64)
# end_date = time.time()
# result_date = start_date - end_date
# return {
# "captcha": captcha,
# "time": format(math.floor(result_date)).replace("-","") + "s"


@app.route('/' , methods=['GET', 'POST','DELETE', 'PATCH'])
def home():
base64few = str(request.form['base64'])
image = base64.b64decode(base64few)
image = Image.open(BytesIO(image))
if image.mode != "RGB":
image.convert("RGB")
image_arr = np.array(image, dtype=np.uint8)
start_date = time.time()
#captcha = Captcha_detection(base64)
res = inference(sess, dectection_graph, image_arr)
end_date = time.time()
result_date = start_date - end_date

#print('I have money {:,.2f} baht'.format(result_date))

return {
"captcha": res,
"time": '{:,.2f}s'.format(result_date).replace("-","")
}


@app.route('/api/images/', methods=['POST'])
def api_images():
if request.is_json:
try:
data_json = request.get_json()
if data_json:
image_base64 = data_json['image']
image = base64.b64decode(image_base64)
image = Image.open(BytesIO(image))
if image.mode != "RGB":
image.convert("RGB")

image_arr = np.array(image, dtype=np.uint8)
# print(image_arr)
res = inference(sess, dectection_graph, image_arr)

return jsonify(answer=res, status=True)
except Exception as e:
return jsonify(answer="", status=False)
return jsonify(answer="", status=False)

@app.route('/api/imgArr/', methods=['POST'])
def api_imgArr():
print(request.get_json())


if __name__ == "__main__":
# app.run(debug=True)
app.debug = False
# app.config["CACHE_TYPE"] = "null"
app.run(host = '0.0.0.0',port=8080)
# serve(TransLogger(app, setup_console_handler=False), threads=20, host = '0.0.0.0',port=5000)
# serve(TransLogger(app, setup_console_handler=False), threads=40, host = '0.0.0.0',port=5000)

3 changes: 3 additions & 0 deletions key_api.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
Pong11299
Apidwalin
bas2563
Loading