Forbid additional fields in API requests

core/web/apiv2/entities.py

@@ -2,28 +2,36 @@
 from typing import Iterable
 
 from fastapi import APIRouter, HTTPException
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, ConfigDict
 
 from core.schemas import entity
 
 
 # Request schemas
 class NewEntityRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     entity: entity.EntityTypes
 
 
 class PatchEntityRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     entity: entity.EntityTypes
 
 
 class EntitySearchRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     name: str | None = None
     type: entity.EntityType | None = None
     count: int = 50
     page: int = 0
 
 
 class EntitySearchResponse(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     entities: list[entity.EntityTypes]
     total: int
 

core/web/apiv2/graph.py

@@ -2,7 +2,7 @@
 from typing import Type
 
 from fastapi import APIRouter, HTTPException
-from pydantic import BaseModel
+from pydantic import BaseModel, ConfigDict
 
 from core.schemas import entity, observable, indicator
 from core.schemas.graph import Relationship
@@ -26,6 +26,8 @@ class GraphDirection(str, Enum):
 
 # TODO: #761 Add Pagination to GraphSearchRequest
 class GraphSearchRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     source: str
     link_types: list[str] = []
     target_types: list[str] = []
@@ -37,16 +39,21 @@ class GraphSearchRequest(BaseModel):
 
 
 class GraphAddRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     source: str
     target: str
     link_type: str
     description: str
 
 
 class GraphSearchResponse(BaseModel):
-    vertices: dict[str, observable.Observable | entity.Entity | indicator.Indicator]
-    edges: list[Relationship]
-    total: int
+
+    model_config = ConfigDict(extra='forbid')
+
+    vertices: dict[str, observable.Observable | entity.Entity | indicator.Indicator | tag.Tag]
+    edges: list[graph.Relationship | graph.TagRelationship]
+
 
 
 # API endpoints

core/web/apiv2/indicators.py

@@ -2,28 +2,36 @@
 from typing import Iterable
 
 from fastapi import APIRouter, HTTPException
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, ConfigDict
 
 from core.schemas import indicator
 
 
 # Request schemas
 class NewIndicatorRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     indicator: indicator.IndicatorTypes
 
 
 class PatchIndicatorRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     indicator: indicator.IndicatorTypes
 
 
 class IndicatorSearchRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     name: str | None = None
     type: indicator.IndicatorType | None = None
     count: int = 50
     page: int = 0
 
 
 class IndicatorSearchResponse(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     indicators: list[indicator.IndicatorTypes]
     total: int
 

core/web/apiv2/observables.py

@@ -2,29 +2,38 @@
 from typing import Iterable
 
 from fastapi import APIRouter, HTTPException
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, ConfigDict
+
 
 from core.schemas.observable import Observable, ObservableType
 from core.schemas.tag import DEFAULT_EXPIRATION_DAYS, Tag
 
 
 # Request schemas
 class NewObservableRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     value: str
     tags: list[str] = []
     type: ObservableType
 
 
 class NewBulkObservableAddRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     observables: list[NewObservableRequest]
 
 
 class AddTextRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     text: str
     tags: list[str] = []
 
 
 class AddContextRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     source: str
     context: dict
     skip_compare: set = set()
@@ -35,6 +44,8 @@ class DeleteContextRequest(AddContextRequest):
 
 
 class ObservableSearchRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     value: str | None = None
     # name: str | None = None
     type: ObservableType | None = None
@@ -44,11 +55,15 @@ class ObservableSearchRequest(BaseModel):
 
 
 class ObservableSearchResponse(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     observables: list[Observable]
     total: int
 
 
 class ObservableTagRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     ids: list[str]
     tags: list[str]
     strict: bool = False

core/web/apiv2/system.py

@@ -1,7 +1,6 @@
 from fastapi import APIRouter
-from pydantic import BaseModel
+from pydantic import BaseModel, ConfigDict
 
-from core.schemas.template import Template
 from core.config.config import yeti_config
 
 # API endpoints
@@ -10,6 +9,7 @@
 
 class SystemConfig(BaseModel):
     """System config template."""
+    model_config = ConfigDict(extra='forbid')
 
     auth: dict
     arangodb: dict

core/web/apiv2/tag.py

@@ -2,24 +2,30 @@
 from typing import Iterable
 
 from fastapi import APIRouter, HTTPException
-from pydantic import BaseModel
+from pydantic import BaseModel, ConfigDict
 
 from core.schemas.tag import DEFAULT_EXPIRATION_DAYS, Tag
 
 
 # Request schemas
 class NewRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     name: str
     default_expiration_days: int = DEFAULT_EXPIRATION_DAYS
     produces: list[str] = []
     replaces: list[str] = []
 
 
 class UpdateRequest(NewRequest):
+    model_config = ConfigDict(extra='forbid')
+
     pass
 
 
 class TagSearchRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     name: str | None = None
     produces: list[str] = []
     replaces: list[str] = []
@@ -28,17 +34,23 @@ class TagSearchRequest(BaseModel):
 
 
 class TagSearchResponse(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     tags: list[Tag]
     total: int
 
 
 class MergeTagRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     merge: list[str]
     merge_into: str
     permanent: bool = False
 
 
 class MergeTagResult(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     merged: int
     into: Tag
 

core/web/apiv2/tasks.py

@@ -1,40 +1,40 @@
-import datetime
 import os
-from typing import Iterable
 
 from fastapi import APIRouter, HTTPException
 from fastapi.responses import FileResponse
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, ConfigDict
 
+from core.schemas.task import ExportTask, Task, TaskParams, TaskType, TaskTypes
 from core import taskmanager
-from core.schemas.task import (
-    TYPE_MAPPING,
-    ExportTask,
-    Task,
-    TaskType,
-    TaskTypes,
-    TaskParams,
-)
 from core.schemas.template import Template
 
+
 # Request schemas
 class TaskSearchRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     name: str | None = None
     type: TaskType | None = None
     count: int = 50
     page: int = 0
 
 
 class TaskSearchResponse(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     tasks: list[TaskTypes]
     total: int
 
 
 class NewExportRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     export: ExportTask
 
 
 class PatchExportRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     export: ExportTask
 
 

core/web/apiv2/templates.py

@@ -1,30 +1,36 @@
-import datetime
-from typing import Iterable
-
 from fastapi import APIRouter, HTTPException
-from fastapi.responses import StreamingResponse, FileResponse
-from pydantic import BaseModel, Field
+from fastapi.responses import StreamingResponse
+from pydantic import BaseModel, ConfigDict
 
-from core.schemas.template import Template
 from core.schemas.observable import Observable
+from core.schemas.template import Template
+
 
 # Request schemas
 class TemplateSearchRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     name: str = ""
     count: int = 50
     page: int = 0
 
 
 class TemplateSearchResponse(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     templates: list[Template]
     total: int
 
 
 class PatchTemplateRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     template: Template
 
 
 class RenderExportRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
     template_id: str
     observable_ids: list[str] | None = None
     search_query: str | None = None