Fix CodeQL Alert for SSRF

[umar8hassan]

What are the relevant tickets?

closes #2175 and closes #2172

Description (What does it do?)

Limited the use of input url. Format for the subscribe url is pre-defined and only token will be used from the message.

How can this be tested?

The scope of this ticket is to test that url was formatted correctly after using the pre-defined url format

• Use the RC settings for AWS_ACCOUNT_ID and AWS_REGION
• Using Postman or curl, make a request to http://localhost:8043/api/transcode-jobs/ with the following data, and headers "Authorization: Bearer <settings.API_BEARER_TOKEN>" and "Content-Type: application/json":

{
 "Type": "SubscriptionConfirmation",
 "MessageId": "88b400b3-2fd3-49a3-b182-f64a4224d3e2",
 "Token": "fake-token",
 "TopicArn": "arn:aws:sns:<AWS_REGION>:<AWS_ACCOUNT_ID>:MediaConvertJobAlert",
 "Message": "To confirm the subscription, visit the SubscribeURL included in this message.",
 "SubscribeURL": "https://sns.<AWS_REGION>.amazonaws.com/?Action=ConfirmSubscription&TopicArn=arn:aws:sns:<AWS_REGION>:<AWS_ACCOUNT_ID>:MediaConvertJobAlert&Token=fake-token",
 "Timestamp": "2021-08-05T14:32:17.423Z",
 "SignatureVersion": "1",
 "Signature": "fake-signature",
 "SigningCertURL": "https://sns.<AWS_REGION>.amazonaws.com/SimpleNotificationService.pem"
}

• The request should return 200 status_code. Which would indicate that url was formatted correctly.

[pt2302]

Could you add a test for this functionality, i.e., making sure that the URL is properly formatted? Also, we are not currently performing validation on some of these fields, such as AWS_ACCOUNT_ID. We should do this, and throw appropriate errors if they are not valid.

[pt2302]

If we are using imports from rest_framework.status here, why would we define them as constants here:

ocw-studio/external_resources/constants.py

Lines 4 to 10 in d6d5cd1

	HTTP_BAD_REQUEST = 400
	HTTP_UNAUTHORIZED = 401
	HTTP_PAYMENT_REQUIRED = 402
	HTTP_FORBIDDEN = 403
	HTTP_TOO_MANY_REQUESTS = 429
	HTTP_REQUEST_TIMEOUT = 408
	HTTP_SERVICE_UNAVAILABLE = 503

For consistency, I think we should make those imports from rest_framework.status as well.

Also, commit messages should ideally contain a summary of what the commit addresses, rather than a more generic message.

[umar8hassan]

@pt2302 I agree with you on this. I'd have changed it if it had been in the same module and scope of work. Changing the constants and testing things again for external resources module for any breaking change, should be done in separate refactoring ticket in my opinion.

[pt2302]

Agreed. I've opened #2198 and put up #2199 to resolve this issue.

[pt2302]

Looks good to me!