Merge pull request #9 from baseVISION/bv-develop

Dep upgrades and bugfixes.

Author: Che4ter

bV-local-dev-environment-setup.md

@@ -56,15 +56,42 @@ podman compose -f docker-compose.bv.yml -p iris-bv up -d
 # Stop (data is preserved in iris-bv_db_data volume)
 podman compose -f docker-compose.bv.yml -p iris-bv down
 
-# Rebuild after code changes
+# Rebuild after code changes (Python backend or Dockerfile changes)
 podman compose -f docker-compose.bv.yml -p iris-bv up -d --build
 
+# Restart app after Python file changes (always restart nginx too — it caches the app's IP)
+podman restart bv-iriswebapp-app bv-iriswebapp-nginx
+
 # View logs
 podman compose -f docker-compose.bv.yml -p iris-bv logs -f bv-iriswebapp-app
 ```
 
 ---
 
+## Working on UI (JavaScript/Svelte) changes
+
+The `ui/dist` folder is bind-mounted into the container at `/iriswebapp/static`, so you can
+iterate on UI changes without rebuilding the container image.
+
+**First time only** — install Node dependencies on your host:
+```bash
+cd ui
+npm install
+```
+
+**On every UI change:**
+```bash
+cd ui
+npm run build
+```
+Then hard-refresh the browser (Ctrl+Shift+R). No container restart needed.
+
+> **Note:** `npm install` is only needed on your host for local builds. The container image
+> runs its own `npm ci` + `npm run build` during `docker build`, so a full `--build` always
+> produces a self-contained image regardless of your local `node_modules`.
+
+---
+
 ## Full cleanup
 
 Remove containers, networks, and all data volumes (⚠ deletes all case data):

docker-compose.bv.yml

@@ -51,9 +51,11 @@ services:
       context: .
       dockerfile: docker/webApp/Dockerfile
     image: bv-iriswebapp-app:develop
-    ports: []
+    ports:
+      - "127.0.0.1:8000:8000"
     volumes:
       - ./source/app:/iriswebapp/app:z
+      - ./ui/dist:/iriswebapp/static:z
     depends_on:
       db:
         condition: service_healthy
@@ -98,6 +100,8 @@ services:
         NGINX_CONF_GID: 1234
         NGINX_CONF_FILE: ${NGINX_CONF_FILE:-nginx.conf}
     image: bv-iriswebapp-nginx:develop
+    security_opt:
+      - "label=disable"
     volumes:
       - "./certificates/web_certificates/:/www/certs/:z"
     depends_on:
@@ -107,7 +111,7 @@ services:
         condition: service_healthy
 
   frontend:
-    image: node:23-alpine
+    image: node:24-alpine
     profiles: ["new-ui"]
     container_name: iris_sveltekit_frontend
     working_dir: /app

docker-compose.dev.yml

@@ -102,7 +102,7 @@ services:
         condition: service_healthy
 
   frontend:
-    image: node:23-alpine
+    image: node:24-alpine
     profiles: ["new-ui"]
     container_name: iris_sveltekit_frontend
     working_dir: /app

docker/nginx/Dockerfile

@@ -17,7 +17,7 @@
 #  Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
 
-FROM nginx:1.27
+FROM nginx:1.30
 
 RUN apt-get update && apt-get install -y curl
 

docker/nginx/nginx.conf

@@ -77,15 +77,6 @@ http {
     proxy_set_header    X-Real-IP           $remote_addr;
     proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
 
-    # FULLY DISABLE SERVER CACHE
-    add_header          Last-Modified $date_gmt;
-    add_header          'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
-    if_modified_since   off;
-    expires             off;
-    etag                off;
-    proxy_no_cache      1;
-    proxy_cache_bypass  1;
-
     # SSL CONF, STRONG CIPHERS ONLY
     ssl_protocols               TLSv1.2 TLSv1.3;
 
@@ -119,6 +110,45 @@ http {
         add_header Strict-Transport-Security    "max-age=31536000: includeSubDomains" always;
         add_header Front-End-Https              on;
 
+        # FULLY DISABLE SERVER CACHE
+        # Moved to server block to fix inheritance issues.
+        # 'always' ensures headers are sent even on error pages.
+        add_header Last-Modified $date_gmt always;
+        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
+        add_header Pragma "no-cache" always;
+        add_header Expires "0" always;
+        if_modified_since off;
+        expires off;
+        etag off;
+        proxy_no_cache 1;
+        proxy_cache_bypass 1;
+
+        location /static {
+            # Enable Caching (Overrides server "off" settings) for static
+            # ----------------------------------------------------
+            expires 1y;
+            add_header Cache-Control "public, max-age=31536000, immutable";
+
+            # Re-enable ETags and Last-Modified so browsers can check for updates
+            etag on;
+            if_modified_since exact;
+
+            # Re-apply Security Headers
+            add_header X-XSS-Protection             "1; mode=block";
+            add_header X-Frame-Options              DENY;
+            add_header X-Content-Type-Options       nosniff;
+            add_header Strict-Transport-Security    "max-age=31536000: includeSubDomains" always;
+            add_header Front-End-Https              on;
+            add_header Content-Security-Policy      $csp_header;
+
+
+            # Standard Proxy Config
+            proxy_pass http://${IRIS_UPSTREAM_SERVER}:${IRIS_UPSTREAM_PORT};
+
+            proxy_no_cache 0;
+            proxy_cache_bypass 0;
+        }
+
         location / {
             proxy_pass  http://${IRIS_UPSTREAM_SERVER}:${IRIS_UPSTREAM_PORT};
 

docker/webApp/Dockerfile

@@ -19,7 +19,7 @@
 ####################
 # COMPILE JS IMAGE #
 ####################
-FROM node:20-alpine AS compile-js-image
+FROM node:24-alpine AS compile-js-image
 
 COPY ui/ /ui
 
@@ -40,10 +40,12 @@ RUN python -m venv /opt/venv
 # Make sure we use the virtualenv:
 ENV PATH="/opt/venv/bin:$PATH"
 
+RUN python -m pip install --upgrade pip wheel
+
 COPY source/dependencies /dependencies
 COPY source/requirements.txt /
 
-RUN pip3 install -r requirements.txt
+RUN python -m pip install --no-cache-dir -r /requirements.txt
 
 ###############
 # BUILD IMAGE #

push_template.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+
+# Define the local template path
+LOCAL_TEMPLATE="local_dev/test_template.docx"
+
+# Container name
+CONTAINER_NAME="bv-iriswebapp-app"
+
+# Find the newest docx file in the user_templates directory inside the container
+LATEST_TEMPLATE_FILE=$(podman exec -it $CONTAINER_NAME sh -c 'ls -t /home/iris/user_templates/*.docx | head -n 1' | tr -d '\r')
+
+if [ -z "$LATEST_TEMPLATE_FILE" ]; then
+    echo "No existing template found in the pod to overwrite. Please upload a template via UI first."
+    exit 1
+fi
+
+echo "Overwriting $LATEST_TEMPLATE_FILE in pod $CONTAINER_NAME..."
+podman cp "$LOCAL_TEMPLATE" "$CONTAINER_NAME:$LATEST_TEMPLATE_FILE"
+echo "Template updated successfully!"

source/app/__init__.py

@@ -17,6 +17,8 @@
 #  Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
 import os
+import bleach
+from markupsafe import Markup
 from flask import Flask
 from flask import g
 from flask import session
@@ -88,7 +90,37 @@ def ac_current_user_has_manage_perms():
     return False
 
 
+# Allowlist for user-defined HTML custom attributes. Matches the frontend
+# do_md_filter_xss() allowlist closely so behavior is consistent across sinks.
+# Explicitly excludes script / iframe / event handlers / javascript: URLs.
+_ATTR_HTML_ALLOWED_TAGS = [
+    'a', 'abbr', 'b', 'blockquote', 'br', 'code', 'div', 'em', 'h1', 'h2', 'h3',
+    'h4', 'h5', 'h6', 'hr', 'i', 'img', 'li', 'ol', 'p', 'pre', 'span', 'strong',
+    'table', 'tbody', 'td', 'th', 'thead', 'tr', 'ul',
+]
+_ATTR_HTML_ALLOWED_ATTRS = {
+    '*': ['class', 'title'],
+    'a': ['href', 'title', 'target', 'rel'],
+    'img': ['src', 'alt', 'title', 'width', 'height'],
+}
+_ATTR_HTML_ALLOWED_PROTOCOLS = ['http', 'https', 'mailto']
+
+
+def _sanitize_attribute_html(value):
+    if value is None:
+        return ''
+    cleaned = bleach.clean(
+        str(value),
+        tags=_ATTR_HTML_ALLOWED_TAGS,
+        attributes=_ATTR_HTML_ALLOWED_ATTRS,
+        protocols=_ATTR_HTML_ALLOWED_PROTOCOLS,
+        strip=True,
+    )
+    return Markup(cleaned)
+
+
 register_jinja_filters(app.jinja_env)
+app.jinja_env.filters['sanitize_attribute_html'] = _sanitize_attribute_html
 
 app.jinja_env.globals.update(user_has_perm=ac_current_user_has_permission)
 app.jinja_env.globals.update(user_has_manage_perms=ac_current_user_has_manage_perms)

source/app/alembic/versions/2b9a1f8c3d47_merge_bv_develop_with_dfir_iris_v2427.py

@@ -0,0 +1,30 @@
+"""Merge bv-develop chain with dfir-iris v2.4.27 chain
+
+Both chains share common ancestor d5a720d1b99b, then diverged:
+- dfir-iris added e5d79b8c4a55 (custom_dashboard tables, 2025-11-10)
+- bv-develop added 3715d4fac4de + afcff5ebcf7c (IOC-case link, force-confirmation setting)
+
+This merge point allows databases migrated from dfir-iris v2.4.27 to be
+upgraded to bv-develop without a crash.
+
+Revision ID: 2b9a1f8c3d47
+Revises: afcff5ebcf7c, e5d79b8c4a55
+Create Date: 2026-05-15 00:00:00.000000
+
+"""
+
+# revision identifiers, used by Alembic.
+revision = '2b9a1f8c3d47'
+down_revision = ('afcff5ebcf7c', 'e5d79b8c4a55')
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    # No schema changes — this is a pure merge point.
+    # Both branches are additive and schema-compatible at this point.
+    pass
+
+
+def downgrade():
+    pass

source/app/alembic/versions/e5d79b8c4a55_add_custom_dashboards_tables.py

@@ -0,0 +1,59 @@
+"""Add tables for custom dashboards
+
+Revision ID: e5d79b8c4a55
+Revises: d6c49c5435c2
+Create Date: 2025-11-10 10:00:00.000000
+
+"""
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+from app.alembic.alembic_utils import _has_table
+
+# revision identifiers, used by Alembic.
+revision = 'e5d79b8c4a55'
+down_revision = 'd5a720d1b99b'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    if not _has_table('custom_dashboard'):
+        op.create_table(
+            'custom_dashboard',
+            sa.Column('id', sa.Integer, primary_key=True),
+            sa.Column('dashboard_uuid', postgresql.UUID(as_uuid=True), server_default=sa.text('gen_random_uuid()'), nullable=False, unique=True),
+            sa.Column('name', sa.String(length=255), nullable=False),
+            sa.Column('description', sa.Text, nullable=True),
+            sa.Column('owner_id', sa.Integer, sa.ForeignKey('user.id'), nullable=False),
+            sa.Column('is_shared', sa.Boolean, nullable=False, server_default=sa.text('false')),
+            sa.Column('definition', postgresql.JSONB, nullable=True),
+            sa.Column('created_at', sa.DateTime, server_default=sa.func.now(), nullable=False),
+            sa.Column('updated_at', sa.DateTime, server_default=sa.func.now(), onupdate=sa.func.now(), nullable=False)
+        )
+
+    if not _has_table('custom_dashboard_widget'):
+        op.create_table(
+            'custom_dashboard_widget',
+            sa.Column('id', sa.Integer, primary_key=True),
+            sa.Column('widget_uuid', postgresql.UUID(as_uuid=True), server_default=sa.text('gen_random_uuid()'), nullable=False, unique=True),
+            sa.Column('dashboard_id', sa.Integer, sa.ForeignKey('custom_dashboard.id', ondelete='CASCADE'), nullable=False),
+            sa.Column('name', sa.String(length=255), nullable=False),
+            sa.Column('chart_type', sa.String(length=64), nullable=False),
+            sa.Column('definition', postgresql.JSONB, nullable=False),
+            sa.Column('position', sa.Integer, nullable=False, server_default=sa.text('0')),
+            sa.Column('created_at', sa.DateTime, server_default=sa.func.now(), nullable=False),
+            sa.Column('updated_at', sa.DateTime, server_default=sa.func.now(), onupdate=sa.func.now(), nullable=False)
+        )
+        op.create_index('ix_custom_dashboard_widget_dashboard_id', 'custom_dashboard_widget', ['dashboard_id'])
+
+
+
+def downgrade():
+    if _has_table('custom_dashboard_widget'):
+        op.drop_index('ix_custom_dashboard_widget_dashboard_id', table_name='custom_dashboard_widget')
+        op.drop_table('custom_dashboard_widget')
+
+    if _has_table('custom_dashboard'):
+        op.drop_table('custom_dashboard')