fix: V-006 security vulnerability

Automated security fix generated by Orbis Security AI

3-Web-App/1-Web-App/solution/web-app/app.py

@@ -1,32 +1,48 @@
-import numpy as np
+import hashlib
-from flask import Flask, request, render_template
+import os
-import pickle
+import numpy as np
-
+from flask import Flask, request, render_template
-app = Flask(__name__)
+import joblib
-
+
-model = pickle.load(open("../ufo-model.pkl", "rb"))
+app = Flask(__name__)
-
+
-
+def _verify_model_integrity(path):
-@app.route("/")
+    expected = os.environ.get("MODEL_SHA256", "")
-def home():
+    if not expected:
-    return render_template("index.html")
+        raise RuntimeError("MODEL_SHA256 environment variable must be set to the expected SHA-256 hex digest of the model file")
-
+    sha256 = hashlib.sha256()
-
+    with open(path, "rb") as f:
-@app.route("/predict", methods=["POST"])
+        for chunk in iter(lambda: f.read(8192), b""):
-def predict():
+            sha256.update(chunk)
-
+    digest = sha256.hexdigest()
-    int_features = [int(x) for x in request.form.values()]
+    if digest != expected:
-    final_features = [np.array(int_features)]
+        raise RuntimeError("Model integrity check failed: file hash does not match MODEL_SHA256")
-    prediction = model.predict(final_features)
+
-
+_MODEL_PATH = "../ufo-model.pkl"
-    output = prediction[0]
+_verify_model_integrity(_MODEL_PATH)
-
+model = joblib.load(_MODEL_PATH)
-    countries = ["Australia", "Canada", "Germany", "UK", "US"]
+
-
+
-    return render_template(
+@app.route("/")
-        "index.html", prediction_text="Likely country: {}".format(countries[output])
+def home():
-    )
+    return render_template("index.html")
-
+
-
+
-if __name__ == "__main__":
+@app.route("/predict", methods=["POST"])
-    app.run(debug=True)
+def predict():
+
+    int_features = [int(x) for x in request.form.values()]
+    final_features = [np.array(int_features)]
+    prediction = model.predict(final_features)
+
+    output = prediction[0]
+
+    countries = ["Australia", "Canada", "Germany", "UK", "US"]
+
+    return render_template(
+        "index.html", prediction_text="Likely country: {}".format(countries[output])
+    )
+
+
+if __name__ == "__main__":
+    app.run(debug=False)