Overview

Open Coding Society accepts user input and supports code execution, so security needs to be enforced across multiple layers. Our capstone focuses on reducing the attack surface of the platform and preventing users from bypassing security protections by sending requests directly to backend APIs.

Defense in Depth

Security checks should not exist only in the frontend. Rules that matter for security must also be enforced by Flask, Spring, and the surrounding infrastructure.

Isolation

Untrusted code should not run inside the same environment as the main application. Dedicated code-runner containers create an additional security boundary.

Security Roadmap

Current progress across the main areas of the project.

Frontend Password complexity requirements on account creation Complete

Flask Flask backend password validation Complete

Spring Spring backend password validation Complete

Flask Runner Run requested Python code in a dedicated Docker container Mostly Complete

Spring Runner Run requested Java code in a dedicated Docker container In Progress

Infrastructure Production/testing configuration and stronger sandboxing Planned

Password Security

Password complexity is now enforced both where the user interacts with the site and where account creation is actually processed.

Complete

Frontend Validation

OCS Pages prevents users from creating an account with a password that does not meet the required password complexity rules.

This gives immediate feedback and reduces invalid requests before they ever reach the backend.

Complete

Backend Enforcement

Both Spring and Flask reject account-creation requests containing passwords that do not meet the required complexity.

This prevents someone from bypassing the Pages frontend and sending a direct API request with an invalid password.

Code Runner Isolation

The next major security improvement is separating command execution from the main backend containers so that untrusted code does not run in the same environment as the application.

Mostly Complete

Flask Code Runner

Flask has mostly been migrated to a dedicated code-runner Docker container. Commands are executed in this isolated environment instead of directly inside the main Flask container.

Current work is focused on smaller configuration improvements, including allowing more code-runner settings to be controlled through .env.

In Progress

Spring Code Runner

A new Docker container has been created for Spring to connect to and use for Java execution.

The current task is fixing the Spring API controller so that it correctly sends Java source code and request data to the new container and returns the execution result.

Future Work

Container separation is an important first step, but additional configuration and hardening can further reduce risk.

Planned

Production vs. Testing

Add separate Spring backend configurations so testing and development settings are not accidentally used in production.

• Separate environment-specific settings
• Control endpoints and services by environment
• Reduce production debugging exposure

Planned

Container Hardening

Add stronger restrictions around the code-runner containers and continue treating submitted code as untrusted.

• CPU and memory limits
• Filesystem restrictions
• Network restrictions
• Non-root execution
• Reduced Linux capabilities
• Execution timeouts
• Additional sandboxing tools

Project Summary

Completed

• Frontend password complexity
• Flask password enforcement
• Spring password enforcement

Working On

• Flask runner configuration
• Spring Java runner integration
• Spring API controller fixes

Future

• Production/testing configuration
• Stricter Docker settings
• Additional sandboxing