fix(security): Address Dependabot and code scanning vulnerabilities (#17)

* fix(security): address Dependabot and code scanning vulnerabilities

- Update Django from 5.0.7 to 5.1.4 to fix critical SQL injection vulnerabilities
- Update asteval from 0.9.31 to 1.0.5 to fix sandbox escape vulnerabilities
- Fix 4 stack trace exposure issues in views.py by using generic error messages
- Add proper logging for error tracking without exposing sensitive information

Fixes 18 open Dependabot alerts and 4 code scanning alerts

* fix: use first Docker tag from metadata for Trivy scanner

* fix: resolve pytest version conflict between requirements files

* style: apply black formatting to views.py

Author: CervezaStallone

.github/workflows/docker.yml

@@ -61,7 +61,7 @@ jobs:
       uses: aquasecurity/trivy-action@master
       if: github.event_name != 'pull_request'
       with:
-        image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ github.sha }}
+        image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
         format: 'sarif'
         output: 'trivy-results.sarif'
 

modbus_app/views.py

@@ -2,6 +2,7 @@
 Views voor de Modbus webapp.
 """
 
+import logging
 from datetime import timedelta
 
 from django.contrib.auth.decorators import login_required
@@ -12,18 +13,37 @@
 from rest_framework.permissions import IsAdminUser, IsAuthenticated
 from rest_framework.response import Response
 
-from .models import (Alarm, AlarmHistory, AuditLog, CalculatedRegister,
-                     DashboardGroup, DashboardWidget, Device, DeviceTemplate,
-                     ModbusInterface, Register, TrendData, TrendDataAggregated)
-from .serializers import (AlarmHistorySerializer, AlarmSerializer,
-                          AuditLogSerializer, CalculatedRegisterSerializer,
-                          DashboardGroupSerializer, DashboardWidgetSerializer,
-                          DeviceListSerializer, DeviceSerializer,
-                          DeviceTemplateSerializer,
-                          ModbusInterfaceListSerializer,
-                          ModbusInterfaceSerializer, RegisterListSerializer,
-                          RegisterSerializer, TrendDataAggregatedSerializer,
-                          TrendDataSerializer)
+from .models import (
+    Alarm,
+    AlarmHistory,
+    AuditLog,
+    CalculatedRegister,
+    DashboardGroup,
+    DashboardWidget,
+    Device,
+    DeviceTemplate,
+    ModbusInterface,
+    Register,
+    TrendData,
+    TrendDataAggregated,
+)
+from .serializers import (
+    AlarmHistorySerializer,
+    AlarmSerializer,
+    AuditLogSerializer,
+    CalculatedRegisterSerializer,
+    DashboardGroupSerializer,
+    DashboardWidgetSerializer,
+    DeviceListSerializer,
+    DeviceSerializer,
+    DeviceTemplateSerializer,
+    ModbusInterfaceListSerializer,
+    ModbusInterfaceSerializer,
+    RegisterListSerializer,
+    RegisterSerializer,
+    TrendDataAggregatedSerializer,
+    TrendDataSerializer,
+)
 from .services.register_service import RegisterService
 
 
@@ -177,8 +197,15 @@ def test_connection(self, request, pk=None):
             )
         except Exception as e:
             interface.update_status("error")
+            logging.getLogger(__name__).error(
+                f"Connection test failed for interface {interface.name}: {str(e)}",
+                exc_info=True,
+            )
             return Response(
-                {"status": "error", "message": str(e)},
+                {
+                    "status": "error",
+                    "message": "Verbinding testen mislukt. Controleer de interface instellingen.",
+                },
                 status=status.HTTP_400_BAD_REQUEST,
             )
         finally:
@@ -292,8 +319,14 @@ def apply_template(self, request, pk=None):
                 status=status.HTTP_404_NOT_FOUND,
             )
         except Exception as e:
+            logging.getLogger(__name__).error(
+                f"Failed to create registers from template: {str(e)}", exc_info=True
+            )
             return Response(
-                {"status": "error", "message": str(e)},
+                {
+                    "status": "error",
+                    "message": "Kon registers niet aanmaken van template. Controleer de template configuratie.",
+                },
                 status=status.HTTP_400_BAD_REQUEST,
             )
 
@@ -369,8 +402,14 @@ def read_now(self, request, pk=None):
                 }
             )
         except Exception as e:
+            logging.getLogger(__name__).error(
+                f"Failed to read register {register.name}: {str(e)}", exc_info=True
+            )
             return Response(
-                {"status": "error", "message": str(e)},
+                {
+                    "status": "error",
+                    "message": "Kon register niet lezen. Controleer de verbinding en register configuratie.",
+                },
                 status=status.HTTP_400_BAD_REQUEST,
             )
 
@@ -408,8 +447,15 @@ def write_value(self, request, pk=None):
                 }
             )
         except Exception as e:
+            logging.getLogger(__name__).error(
+                f"Failed to write value to register {register.name}: {str(e)}",
+                exc_info=True,
+            )
             return Response(
-                {"status": "error", "message": str(e)},
+                {
+                    "status": "error",
+                    "message": "Kon waarde niet schrijven naar register. Controleer of het register schrijfbaar is en de waarde geldig is.",
+                },
                 status=status.HTTP_400_BAD_REQUEST,
             )
 

requirements.txt

@@ -1,7 +1,7 @@
 amqp==5.3.1
 anyio==4.12.0
 asgiref==3.11.0
-asteval==0.9.31
+asteval==1.0.5
 attrs==25.4.0
 autobahn==25.12.1
 Automat==25.4.16
@@ -52,8 +52,8 @@ Pygments==2.19.2
 pymodbus==3.5.0
 pyOpenSSL==25.3.0
 pyserial==3.5
-pytest==8.3.4
-pytest-cov==6.0.0
+pytest==9.0.2
+pytest-cov==7.0.0
 pytest-django==4.11.1
 python-crontab==3.3.0
 python-dateutil==2.9.0.post0