renfe_mcp_server

The project demonstrates a very strong emphasis on security, particularly for web scraping and API server vulnerabilities. Key strengths include: - **SSRF Prevention**: Extensive URL validation (domain whitelisting, HTTPS enforcement, local IP blocking, limited redirects) is implemented in `scraper.py` and `update_data.py` to prevent Server-Side Request Forgery. - **Zip Slip Prevention**: The `safe_extract_zip` function in `update_data.py` is robust, preventing path traversal, absolute path usage, filtering disallowed file extensions, and enforcing size limits (for individual files and total extraction) to mitigate zip bombs. - **Authentication**: Supports API key authentication with secure hashing (`SHA-256`) and constant-time comparison (`secrets.compare_digest`) to prevent timing attacks. - **Rate Limiting**: A token-bucket rate limiter is implemented per client, with separate, stricter limits for resource-intensive price scraping requests. - **Security Logging**: A dedicated security logger is in place, capable of redacting sensitive data (e.g., API keys, passwords) and hashing identifiers (e.g., origin/destination names) before logging, enhancing privacy and incident response capabilities. - **Configuration Validation**: Uses Pydantic for typed and validated configuration, and clearly flags 'dev_mode' as insecure for production. No 'eval' or other easily exploitable code patterns were identified that lack clear justification. The security posture is exceptionally strong for an open-source project.