Security & PII Protection
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
The Security & PII (Personally Identifiable Information) Protection system in the Rosy Tax Processor is designed to ensure safe handling of sensitive financial documents throughout the document ingestion and processing lifecycle. Its primary objective is to prevent the exposure of sensitive data like Social Security Numbers (SSNs) and to defend the application against common upload-based vulnerabilities.
The system implements a multi-layered security approach including file-level validation, data sanitization, and automated cleanup of temporary assets. By default, the system is designed to run locally, ensuring that no data is transmitted to external servers during the tax processing workflow.
Sources: README.md:95-103, SETUP.md:65-70
Input Validation and File Security
Rosy implements strict controls on files uploaded to the /upload endpoint. These controls mitigate risks such as path traversal attacks, remote code execution through malicious file types, and denial-of-service through large file uploads.
File Sanitization and Constraints
When a file is received, the system sanitizes the filename to remove dangerous characters and limits the upload size.
- Filename Sanitization: The
sanitize_filenamefunction strips path components usingos.path.basenameand uses regular expressions to keep only alphanumeric characters, dots, dashes, and underscores. It further truncates the name to 200 characters. - Extension Validation: Only specific extensions are permitted:
.pdf,.txt,.png,.jpg, and.jpeg. - Size Limits: Individual file uploads are restricted to a maximum of 5 MB.
Sources: security.py:8-25, backend.py:56-68
Security Configuration
| Configuration Constant | Value | Description |
|---|---|---|
ALLOWED_EXT | {'.pdf', '.txt', '.png', '.jpg', '.jpeg'} | Set of permitted file extensions for processing. |
MAX_UPLOAD_BYTES | 5,242,880 (5 MB) | Maximum allowed size per uploaded file. |
Sources: security.py:9-10
PII Masking and Data Privacy
To protect user privacy in API responses, the system implements automated PII masking, specifically targeting Social Security Numbers.
Masking Logic
The system uses the mask_pii_in_result function to recursively traverse result dictionaries and lists. If a string value matches the standard SSN format (###-##-####), it is transformed into a masked version (XXX-XX-####).
def mask_ssn_in_text(s: str) -> str:
# mask SSNs like 123-45-6789 -> XXX-XX-6789
if not s:
return s
return re.sub(r"\b(\d{3})-(\d{2})-(\d{4})\b", r"XXX-XX-\3", s)
Sources: security.py:28-33, security.py:36-55
Data Flow Diagram
The following diagram illustrates how security checks and PII masking are integrated into the processing pipeline:
Sources: backend.py:54-93, security.py:36-55
Temporary Storage and Cleanup
The system utilizes isolated temporary directories for each processing session to prevent data leakage between requests.
- Isolated Directories: Directories are created using
tempfile.mkdtempwith prefixes likerosy_upload_orrosy_final_. - Access Control: The
/downloadhelper endpoint includes a security check to ensure it only serves files from directories containing therosy_upload_prefix, preventing arbitrary path traversal. - Automated Deletion: Upon completion of the
/uploadrequest, the system attempts to remove the original uploaded files from the server.
Sources: backend.py:44-52, backend.py:57, backend.py:87-91
Testing Security Features
The project includes a dedicated test suite (tests/test_security.py) to verify the effectiveness of security measures.
Sequence of Security Validation
The following sequence diagram shows the interaction during a security-validated upload:
Sources: tests/test_security.py:10-33
Summary of Protection Measures
The Security & PII Protection module provides a baseline of safety for the prototype system. By combining file-system security (sanitization and size limits) with data-layer security (PII masking), the system minimizes the risk of sensitive data exposure during local execution. For production environments, the documentation recommends additional measures such as HTTPS, virus scanning, and data-at-rest encryption.
Sources: README.md:105-111, security.py:1-6