fix: fix security issue in app.py

[anupamme]

Summary

Fix high severity security issue in app.py.

Vulnerability

Field	Value
ID	V-003
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-003
File	app.py:97
Assessment	Likely exploitable
Chain Complexity	2-step

Description: The application exposes 74+ API endpoints without implementing preventive rate limiting middleware. While a quota tracking system exists in model/log_quota.py, it only records usage after requests are processed rather than preventing abuse. This reactive approach allows resource exhaustion attacks to succeed before any limits are enforced.

Evidence

Exploitation scenario: An attacker can send high-volume automated requests to any endpoint including /api/search, /data, and /past_data.

Scanner confirmation: multi_agent_ai rule V-003 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This main application appears to be publicly accessible. This is a web service - vulnerabilities in request handlers are directly exploitable by remote attackers.

Changes

• app.py

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

Security Invariant

Property: The security boundary is maintained under adversarial input

Regression test

import pytest
import time
from app import app


@pytest.mark.parametrize("payload", [
    {"query": "a" * 10000, "type": "votes"},  # oversized payload
    {"query": "x", "type": "members"},        # minimal valid
    {"query": "test", "type": "votes"},       # normal valid
])
def test_rate_limiting_enforced(payload):
    """Invariant: Rapid sequential requests must be throttled to prevent resource exhaustion."""
    client = app.test_client()
    
    # Burst of requests to detect missing rate limiting
    start = time.time()
    responses = []
    for _ in range(10):
        resp = client.post("/api/search", json=payload)
        responses.append(resp.status_code)
    elapsed = time.time() - start
    
    # If no rate limiting: all 10 requests succeed quickly (<1s)
    # With rate limiting: should see 429s or significant delay
    success_count = sum(1 for r in responses if r == 200)
    
    # Security invariant: not all burst requests should succeed unthrottled
    assert success_count < 10 or elapsed > 1.0, \
        "Rate limiting not enforced: all burst requests succeeded immediately"

This test guards against regressions — it's useful independent of the code change above.

---

Automated security fix by OrbisAI Security