05/24 Fix Security bugs

app.py

@@ -29,6 +29,9 @@ def create_app():
         )
     app.secret_key = secret_key or os.urandom(32)
 
+    # ── Upload size limit (20 MB) ──────────────────────────────────────────────
+    app.config["MAX_CONTENT_LENGTH"] = 20 * 1024 * 1024
+
     # ── Session timeout (30 minutes) ──────────────────────────────────────────
     from datetime import timedelta
     app.permanent_session_lifetime = timedelta(minutes=30)
@@ -70,10 +73,31 @@ def create_app():
     from flask_wtf.csrf import CSRFProtect
     CSRFProtect(app)
 
-    # ── Template context processors ────────────────────────────────────────────
-    from flask import session, redirect, url_for, g
+    # ── Security response headers ──────────────────────────────────────────────
+    from flask import session, redirect, url_for, g, request, jsonify, flash
     import functools
 
+    @app.after_request
+    def set_security_headers(response):
+        response.headers["X-Frame-Options"] = "SAMEORIGIN"
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
+        return response
+
+    # ── 413 handler: file too large ────────────────────────────────────────────
+    from werkzeug.exceptions import RequestEntityTooLarge
+
+    @app.errorhandler(RequestEntityTooLarge)
+    def handle_too_large(e):
+        max_mb = app.config.get("MAX_CONTENT_LENGTH", 0) // (1024 * 1024)
+        msg = f"Upload too large. Maximum allowed size is {max_mb} MB."
+        if request.path.startswith("/ai-summary/"):
+            return jsonify({"error": msg}), 413
+        flash(msg, "danger")
+        return redirect(request.referrer or url_for("index")), 413
+
+    # ── Template context processors ────────────────────────────────────────────
+
     # ── Custom template filter: timedelta/time → "HH:MM" ──────────────────────
     import datetime as _dt