Security: per-fold temp file, input length cap, pinned 3Dmol + SRI

app.py

@@ -20,6 +20,7 @@ import io
 import itertools
 import json
 import os
+import tempfile
 import time
 import gradio as gr
 from ImmuneBuilder import ABodyBuilder2
@@ -490,7 +491,11 @@ CONTROLLER_JS = """
 
   if (!window.$3Dmol) {
     const s = document.createElement("script");
-    s.src = "https://3Dmol.org/build/3Dmol-min.js";
+    // Pinned, immutable version + Subresource Integrity so a compromised CDN
+    // cannot inject arbitrary JS into users' browsers.
+    s.src = "https://cdn.jsdelivr.net/npm/3dmol@2.5.5/build/3Dmol-min.js";
+    s.integrity = "sha384-OsczYbldvrHgslr9fFp/i4GiLSeuw9l+QIlv99ITw8soOwXcoGeflFMLg+CU/X1d";
+    s.crossOrigin = "anonymous";
     s.onload = () => window.myabsInit();
     document.head.appendChild(s);
   } else { window.myabsInit(); }
@@ -499,23 +504,33 @@ CONTROLLER_JS = """
 
 
 # ---------------------------------------------------------------------- fold
+MAX_CHAIN_LEN = 250  # antibody variable domains are ~110-130 aa; a generous DoS cap
+
+
 def fold(heavy: str, light: str):
     """Fold VH+VL, scan liabilities, and hand the structure to the client viewer."""
     heavy, light = clean(heavy), clean(light)
     reset_btn = gr.update(value="▶ Spin")
+    # trailing 7 outputs (everything after `status`) for the early-return paths
+    tail = ("", None, "", [], [], {"H": [], "L": []}, reset_btn)
     if not heavy or not light:
-        return ("Enter both a heavy and a light chain.", "", None, "",
-                [], [], {"H": [], "L": []}, reset_btn)
+        return ("Enter both a heavy and a light chain.",) + tail
+    if len(heavy) > MAX_CHAIN_LEN or len(light) > MAX_CHAIN_LEN:
+        return (f"Sequence too long (VH {len(heavy)}, VL {len(light)} aa; max "
+                f"{MAX_CHAIN_LEN} per chain). Paste one antibody variable domain per box.",) + tail
     try:
         t0 = time.time()
         antibody = PREDICTOR.predict({"H": heavy, "L": light})
         dt = time.time() - t0
-        antibody.save("myabs_fold.pdb")
-    except Exception as e:  # OpenMM refinement / numbering can occasionally fail
-        return (f"Fold failed: {e}", "", None, "",
-                [], [], {"H": [], "L": []}, reset_btn)
-
-    pdb = open("myabs_fold.pdb").read()
+        # Per-fold unique dir so concurrent public users never share the output
+        # file (the download basename stays a clean "myabs_fold.pdb").
+        out_path = os.path.join(tempfile.mkdtemp(prefix="myabs_"), "myabs_fold.pdb")
+        antibody.save(out_path)
+    except Exception:  # OpenMM refinement / numbering can occasionally fail
+        return ("Fold failed. Check that both inputs are valid antibody "
+                "variable-domain sequences.",) + tail
+
+    pdb = open(out_path).read()
     flags, highlights, h3_len, ok = developability(heavy, light, pdb)
     status = (f"Folded in {dt:.1f} s  ·  VH {len(heavy)} aa / VL {len(light)} aa  ·  "
               f"CDRs highlighted (H: yellow/orange/red, L: cyan/blue).")
@@ -525,7 +540,7 @@ def fold(heavy: str, light: str):
     l_tokens, l_idx = build_track("L", number_chain(light) or [], highlights.get("L", []))
     idxmap = {"H": h_idx, "L": l_idx}
     payload = build_payload(pdb, highlights)  # -> client-side viewer via .change bridge
-    return (status, flags_md, "myabs_fold.pdb", payload,
+    return (status, flags_md, out_path, payload,
             h_tokens, l_tokens, idxmap, reset_btn)