GithubHelp home page GithubHelp logo

nexmo-community / sms-aws-sqs-python-sender Goto Github PK

View Code? Open in Web Editor NEW
0.0 11.0 1.0 15 KB

Python Flask AWS Lambda function to store sms messages to AWS SQS for sending, and added route to send.

License: MIT License

Python 100.00%
python aws aws-lambda aws-sqs nexmo-sms vonage-api flask

sms-aws-sqs-python-sender's Introduction

sms-aws-sqs-python-sender

❗❗❗ This repo is now deprecated. Check the Vonage Developer Blog for more blog posts and tutorials. For more sample Vonage projects, check the Vonage Community GitHub repo.

Python function to store bulk sms messages to AWS SQS for 1 per second sending.

Prerequisites

Setup Instructions

Clone this repo from GitHub, and navigate into the newly created directory to proceed.

Environment

Rename .env.default to .env and add values to VONAGE_API_KEY and VONAGE_API_SECRET provided by your Vonage Video APIs account.

AWS Setup

You will need to create AWS credentials as indicated by Serverless. Update the .env file with these.

Also, create a new SQS FIFO queue using the default settings, and update .env with the SQS queue URL. By using FIFO, it ensures messages are sent in the order they were stored.

Usage

To start, create a virtualenv from within the project root to contain the project as you proceed. Then activate it as follows:

virtualenv venv --python=python3
source venv/bin/activate

Next, initialize npm and follow the prompts selecting the defaults. Unless you desire to change any of them. Also, use npm to install needed dependencies for dev to enable Serverless and Lambda to work with the Flask app.

npm init
npm install --save-dev serverless-wsgi serverless-python-requirements

Now you can use pip to install the required Python dependencies. The dependencies are already listed in the requirements.txt, so instruct pip to use it.

pip install -r requirements.txt

Running Local

You can run the app locally and test things out, prior to deploying to AWS Lambda, you can serve it with the following command:

sls wsgi serve

By default this will serve the app at http://localhost:5000. Hitting Ctrl+c will close it down.

Deploy to Lambda

With all the above finished successfully, you can now use Serverless to deploy the app to AWS Lambda.

sls deploy

Available Endpoints

There are 4 URL endpoints available with this client:

  • GET request to /

    • Doesn't perform any actions, but provides a quick way to test
  • POST request to /add

    • This will store the message in SQS.
    • Pass a POST with a JSON body like the following. Substitute the placeholders, indicated with <> with your data.
    • The result will be contain the SQS MessageId.
{
    "from": "<your_name_or_number>",
    "message": "<sms_message_contents>",
    "to": "<recipients_number>"
}
  • GET request to /process
    • Kicks off the sending process.
    • Retrieves the message from SQS FIFO queue.
    • Connects to Nexmo, and sends the SMS message.
location=None, media_mode=relayed, archive_mode=manual
Examples:

Go to the URL provided by the deploy process. Below are some examples of what sample requests may look like: (Your URL will vary.)

GET https://7ulasfasdasdfw4.execute-api.us-east-1.amazonaws.com/dev/

The / endpoint returns the generic message.

POST https://7ulasfasdasdfw4.execute-api.us-east-1.amazonaws.com/dev/add

The add endpoint will return the SQS MessageId.

GET https://7ulasfasdasdfw4.execute-api.us-east-1.amazonaws.com/dev/process

The process endpoing will return a message indicating a successful send.

Deactivating Virtualenv

To exit the virtualenv you can deactivate it, when desired.

deactivate

NOTE: Depending on OS, you may need to prepend virtualenv to the command above.

Contributing

We love questions, comments, issues - and especially pull requests. Either open an issue to talk to us, or reach us on twitter: https://twitter.com/VonageDev.

sms-aws-sqs-python-sender's People

Contributors

adamculp avatar maxkahan avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Forkers

adamculp

sms-aws-sqs-python-sender's Issues

nexmo-2.5.2-py2.py3-none-any.whl: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - nexmo-2.5.2-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (nexmo version) Remediation Possible**
CVE-2022-23491 High 7.5 certifi-2022.9.24-py3-none-any.whl Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-23491

Vulnerable Library - certifi-2022.9.24-py3-none-any.whl

Python package for providing Mozilla's CA Bundle.

Library home page: https://files.pythonhosted.org/packages/1d/38/fa96a426e0c0e68aabc68e896584b83ad1eec779265a028e156ce509630e/certifi-2022.9.24-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

  • nexmo-2.5.2-py2.py3-none-any.whl (Root Library)
    • requests-2.28.1-py3-none-any.whl
      • certifi-2022.9.24-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.

Publish Date: 2022-12-07

URL: CVE-2022-23491

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-23491

Release Date: 2022-12-07

Fix Resolution: certifi - 2022.12.07

Werkzeug-2.2.2-py3-none-any.whl: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - Werkzeug-2.2.2-py3-none-any.whl

The comprehensive WSGI web application library.

Library home page: https://files.pythonhosted.org/packages/c8/27/be6ddbcf60115305205de79c29004a0c6bc53cec814f733467b1bb89386d/Werkzeug-2.2.2-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt,/requirements.txt

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (Werkzeug version) Remediation Possible**
CVE-2023-25577 High 7.5 Werkzeug-2.2.2-py3-none-any.whl Direct Werkzeug - 2.2.3
CVE-2023-23934 Low 3.5 Werkzeug-2.2.2-py3-none-any.whl Direct Werkzeug - 2.2.3

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-25577

Vulnerable Library - Werkzeug-2.2.2-py3-none-any.whl

The comprehensive WSGI web application library.

Library home page: https://files.pythonhosted.org/packages/c8/27/be6ddbcf60115305205de79c29004a0c6bc53cec814f733467b1bb89386d/Werkzeug-2.2.2-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt,/requirements.txt

Dependency Hierarchy:

  • Werkzeug-2.2.2-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses request.data, request.form, request.files, or request.get_data(parse_form_data=False), it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers. Version 2.2.3 contains a patch for this issue.

Publish Date: 2023-02-14

URL: CVE-2023-25577

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-25577

Release Date: 2023-02-14

Fix Resolution: Werkzeug - 2.2.3

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-23934

Vulnerable Library - Werkzeug-2.2.2-py3-none-any.whl

The comprehensive WSGI web application library.

Library home page: https://files.pythonhosted.org/packages/c8/27/be6ddbcf60115305205de79c29004a0c6bc53cec814f733467b1bb89386d/Werkzeug-2.2.2-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt,/requirements.txt

Dependency Hierarchy:

  • Werkzeug-2.2.2-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like =value instead of key=value. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like =__Host-test=bad for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie =__Host-test=bad as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.

Publish Date: 2023-02-14

URL: CVE-2023-23934

CVSS 3 Score Details (3.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Adjacent
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-23934

Release Date: 2023-02-14

Fix Resolution: Werkzeug - 2.2.3

⛑️ Automatic Remediation will be attempted for this issue.


⛑️Automatic Remediation will be attempted for this issue.

Flask-2.2.2-py3-none-any.whl: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - Flask-2.2.2-py3-none-any.whl

A simple framework for building complex web applications.

Library home page: https://files.pythonhosted.org/packages/0f/43/15f4f9ab225b0b25352412e8daa3d0e3d135fcf5e127070c74c3632c8b4c/Flask-2.2.2-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (Flask version) Remediation Possible**
CVE-2023-30861 High 7.5 Flask-2.2.2-py3-none-any.whl Direct flask - 2.2.5,2.3.2

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-30861

Vulnerable Library - Flask-2.2.2-py3-none-any.whl

A simple framework for building complex web applications.

Library home page: https://files.pythonhosted.org/packages/0f/43/15f4f9ab225b0b25352412e8daa3d0e3d135fcf5e127070c74c3632c8b4c/Flask-2.2.2-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

  • Flask-2.2.2-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

  1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
  2. The application sets session.permanent = True
  3. The application does not access or modify the session at any point during a request.
  4. SESSION_REFRESH_EACH_REQUEST enabled (the default).
  5. The application does not set a Cache-Control header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the Vary: Cookie header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.

Publish Date: 2023-05-02

URL: CVE-2023-30861

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-30861

Release Date: 2023-05-02

Fix Resolution: flask - 2.2.5,2.3.2

⛑️ Automatic Remediation will be attempted for this issue.


⛑️Automatic Remediation will be attempted for this issue.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.