Disable werkzeug header generation for files served via mod_xsendfile

[zenmonkeykstop]

Status

Draft mode

Description of Changes

Fixes #7186.

By default, when flask serves a file in response to a partial content request, it (or rather werkzeug) generates the necessary Content-length and Content-range headers itself. Production SD instances use mod_xsendfile to speed up downloads, but mod_xsendfile skips handling responses where said headers are already set.

This PR checks whether USE_X_SENDFILE is set, and if so, it disables extra header generation for partial content responses, allowing mod_xsendfile to handle them instead.

Testing

dev environment

• The range request section of the 2.9.0 test plan (https://github.com/freedomofpress/securedrop/wiki/2.9.0-Test-Plan#api-range-request-support-7160) passes against an environment configured with make dev

prod environment (VMs ok)

• Set up a production environment and install the securedrop-app-code deb built from this branch on the application server
• The range request section of the 2.9.0 test plan (https://github.com/freedomofpress/securedrop/wiki/2.9.0-Test-Plan#api-range-request-support-7160) passes successfully
  How should the reviewer test this PR?
  Write out any special testing steps here.

Deployment

Any special considerations for deployment? Consider both:

n/a

Checklist

If you made non-trivial code changes:

• I have written a test plan and validated it for this PR

[eloquence]

Looks good in dev env:

• verify that you can download the full submission: curl -v -H "Authorization: Token $TOKEN" -o logo.png.gpg http://<JI_address>$DOWNLOAD_URL
• verify that you can download the first 100 bytes of the submission: curl -v -H "Authorization: Token $TOKEN" -H "Range: bytes=0-99" -o logo.png.gpg.part-0-99 http://l<JI_address>$DOWNLOAD_URL
• Verify that the first 100 bytes of the original submission has the same sha256 hash as the partial download.

Now for the prod test.

[eloquence]

A comment explaining why we're doing this might be nice so we don't forget.

[zenmonkeykstop]

To avoid pushing further code changes I just beefed up the commit message. Please restamp if all looks well.

[eloquence]

Shuttled the .deb from this branch to my prod server and installed it there.

(TIL that you have to run curl with curl --socks5-hostname 127.0.0.1:9150 via SOCKS proxy to avoid getting "Not resolving .onion address" errors.)

Looks good there as well.

• verify that you can download the full submission: curl -v -H "Authorization: Token $TOKEN" -o logo.png.gpg http://<JI_address>$DOWNLOAD_URL
• verify that you can download the first 100 bytes of the submission: curl -v -H "Authorization: Token $TOKEN" -H "Range: bytes=0-99" -o logo.png.gpg.part-0-99 http://l<JI_address>$DOWNLOAD_URL
• Verify that the first 100 bytes of the original submission has the same sha256 hash as the partial download.

[eloquence]

Response headers in prod look good as well:

 Date: Mon, 24 Jun 2024 21:04:14 GMT
< Server: Apache
< X-Frame-Options: DENY
< Referrer-Policy: no-referrer
< Cross-Origin-Opener-Policy: same-origin
< Cross-Origin-Embedder-Policy: same-origin
< Cross-Origin-Resource-Policy: same-origin
< X-Content-Type-Options: nosniff
< Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; frame-ancestors 'none';
< Last-Modified: Mon, 24 Jun 2024 20:24:23 GMT
< Content-Disposition: attachment; filename=1-dynastic_bedspring-doc.gz.gpg
< Cache-Control: no-store
< Etag: sha256:1a74419e78276a2840fe6466c80979ee44e96e4f85aca500516579245524cb14
< Accept-Ranges: bytes
< Content-Length: 101
< Content-Range: bytes 0-100/994713
< Content-Type: application/pgp-encrypted
< 

[eloquence]

LGTM and appears to work as intended! One suggestion inline, up to you. Other than that, should the title of this PR be "[2.9.0]" given that it is targeting develop?

[zenmonkeykstop]

It's a 2.9.0 fix but I have no problem editing it

[eloquence]

(I may be out of date, I'm used to the convention of having the "[x.x.x]" in the PR title if it's a backport targeting a release branch.)