GuardianUnivalle-Benito-Yucra 0.1.38__py3-none-any.whl → 0.1.39__py3-none-any.whl

GuardianUnivalle_Benito_Yucra/detectores/detector_sql.py

@@ -1,15 +1,11 @@
 # sql_defense.py
-from __future__ import annotations
+# sql_defense.py - versión robusta y precisa
 import json
 import logging
 import re
-from typing import List, Tuple
-from django.conf import settings
 from django.utils.deprecation import MiddlewareMixin
+from django.conf import settings
 
-# =====================================================
-# ===             CONFIGURACIÓN DEL LOGGER           ===
-# =====================================================
 logger = logging.getLogger("sqlidefense")
 logger.setLevel(logging.INFO)
 if not logger.handlers:
@@ -17,154 +13,95 @@ if not logger.handlers:
     handler.setFormatter(logging.Formatter("%(asctime)s - %(levelname)s - %(message)s"))
     logger.addHandler(handler)
 
-
-# =====================================================
-# ===        PATRONES DE DETECCIÓN DE SQLi           ===
-# =====================================================
-SQLI_PATTERNS: List[Tuple[re.Pattern, str]] = [
-    # Inyección clásica con UNION SELECT
-    (re.compile(r"\bunion\b\s+(all\s+)?\bselect\b", re.I), "Uso de UNION SELECT"),
-    # Combinaciones OR/AND en consultas WHERE
-    (
-        re.compile(r"\bselect\b.*\bfrom\b.*\bwhere\b.*\b(or|and)\b.*=", re.I),
-        "SELECT con OR/AND",
-    ),
-    # Comparaciones tautológicas (1=1)
-    (
-        re.compile(r"\b(or|and)\s+\d+\s*=\s*\d+", re.I),
-        "Expresión tautológica OR/AND 1=1",
-    ),
-    # Manipulación de tablas
-    (
-        re.compile(r"\b(drop|truncate|delete|insert|update)\b", re.I),
-        "Comando de manipulación de tabla",
-    ),
-    # Comentarios sospechosos o terminadores
-    (re.compile(r"(--|#|;)", re.I), "Comentario o terminador sospechoso"),
-    # Ejecución directa de procedimientos
-    (re.compile(r"exec\s*\(", re.I), "Ejecución de procedimiento almacenado"),
-    # Subconsultas y SELECT anidados sospechosos
-    (re.compile(r"\(\s*select\b.*\)", re.I), "Subconsulta sospechosa"),
+# Patrones organizados por nivel de severidad
+SQL_PATTERNS = [
+    # Ataques fuertes (bloqueo inmediato)
+    (re.compile(r"\bunion\b\s+(all\s+)?\bselect\b", re.I), "Uso de UNION SELECT", 0.7),
+    (re.compile(r"\bor\b\s+'?\d+'?\s*=\s*'?\d+'?", re.I), "Tautología OR 1=1", 0.6),
+    (re.compile(r"\bselect\b.+\bfrom\b", re.I), "Consulta SQL SELECT-FROM", 0.5),
+    (re.compile(r"(--|#|/\*|\*/)", re.I), "Comentario SQL sospechoso", 0.4),
+    (re.compile(r"\b(drop|truncate|delete|insert|update)\b", re.I), "Manipulación SQL", 0.5),
+    (re.compile(r"exec\s*\(", re.I), "Ejecución de procedimiento almacenado", 0.6),
 ]
 
+# Campos que deben ser analizados con cuidado o ignorados
+IGNORED_FIELDS = ["password", "csrfmiddlewaretoken", "token", "auth"]
 
-# =====================================================
-# ===          FUNCIONES AUXILIARES SQLi             ===
-# =====================================================
-def extract_payload_text(request) -> str:
-    """
-    Extrae texto de interés desde el cuerpo, querystring,
-    encabezados y referencias para analizar posible SQLi.
-    """
-    parts: List[str] = []
+def get_client_ip(request):
+    x_forwarded_for = request.META.get("HTTP_X_FORWARDED_FOR")
+    if x_forwarded_for:
+        return x_forwarded_for.split(",")[0].strip()
+    return request.META.get("REMOTE_ADDR", "")
 
+def extract_body(request):
     try:
-        content_type = request.META.get("CONTENT_TYPE", "")
-        if "application/json" in content_type:
+        if "application/json" in request.META.get("CONTENT_TYPE", ""):
             data = json.loads(request.body.decode("utf-8") or "{}")
-            parts.append(json.dumps(data))
         else:
-            body = request.body.decode("utf-8", errors="ignore")
-            if body:
-                parts.append(body)
+            data = request.POST.dict() or {}
     except Exception:
-        pass
-
-    qs = request.META.get("QUERY_STRING", "")
-    if qs:
-        parts.append(qs)
-
-    parts.append(request.META.get("HTTP_USER_AGENT", ""))
-    parts.append(request.META.get("HTTP_REFERER", ""))
-
-    return " ".join([p for p in parts if p])
+        data = {}
+    return data
 
+def detect_sql_injection(value: str):
+    score_total = 0.0
+    descripciones = []
+    matches = []
 
-def detect_sql_attack(text: str) -> Tuple[bool, List[str]]:
-    """
-    Recorre el texto buscando patrones típicos de inyección SQL.
-    Retorna (True, lista_de_descripciones) si se detecta algún patrón.
-    """
-    descripcion: List[str] = []
+    for pattern, desc, weight in SQL_PATTERNS:
+        if pattern.search(value):
+            score_total += weight
+            descripciones.append(desc)
+            matches.append(pattern.pattern)
 
-    for patt, msg in SQLI_PATTERNS:
-        if patt.search(text):
-            descripcion.append(msg)
+    return score_total, descripciones, matches
 
-    return (len(descripcion) > 0, descripcion)
-
-
-def get_client_ip(request) -> str:
-    """
-    Obtiene la IP real del cliente considerando X-Forwarded-For.
-    """
-    x_forwarded_for = request.META.get("HTTP_X_FORWARDED_FOR")
-    if x_forwarded_for:
-        return x_forwarded_for.split(",")[0].strip()
-    return request.META.get("REMOTE_ADDR", "")
-
-
-# =====================================================
-# ===          MIDDLEWARE DE DEFENSA SQLi            ===
-# =====================================================
 class SQLIDefenseMiddleware(MiddlewareMixin):
-    """
-    Middleware profesional de detección de inyección SQL.
-    - Detecta patrones en parámetros, cuerpo y cabeceras.
-    - No bloquea directamente; marca el intento para auditoría.
-    """
-
     def process_request(self, request):
-        # ---------------------------------------------
-        # 1. Filtrar IPs confiables
-        # ---------------------------------------------
         client_ip = get_client_ip(request)
-        trusted_ips: List[str] = getattr(settings, "SQLI_DEFENSE_TRUSTED_IPS", [])
+        trusted_ips = getattr(settings, "SQLI_DEFENSE_TRUSTED_IPS", [])
+
         if client_ip in trusted_ips:
             return None
 
-        # ---------------------------------------------
-        # 2. Extraer payload de la solicitud
-        # ---------------------------------------------
-        payload = extract_payload_text(request)
-        if not payload:
-            return None
+        data = extract_body(request)
+        score = 0.0
+        all_desc = []
+        all_matches = []
 
-        # ---------------------------------------------
-        # 3. Analizar contenido en busca de patrones SQLi
-        # ---------------------------------------------
-        flagged, descripcion = detect_sql_attack(payload)
-        if not flagged:
-            return None
+        for key, value in data.items():
+            if not isinstance(value, str):
+                continue
+            if key.lower() in IGNORED_FIELDS:
+                continue  # No analizar contraseñas ni tokens
+
+            s, desc, matches = detect_sql_injection(value)
+            score += s
+            all_desc.extend(desc)
+            all_matches.extend(matches)
 
-        # ---------------------------------------------
-        # 4. Calcular puntaje de amenaza S_sqli
-        # ---------------------------------------------
-        w_sqli = getattr(settings, "SQLI_DEFENSE_WEIGHT", 0.4)
-        detecciones_sqli = len(descripcion)
-        s_sqli = w_sqli * detecciones_sqli
+        if score == 0:
+            return None  # nada sospechoso
 
-        # ---------------------------------------------
-        # 5. Registrar e informar el intento
-        # ---------------------------------------------
         logger.warning(
-            "Inyección SQL detectada desde IP %s: %s ; payload: %.200s ; score: %.2f",
-            client_ip,
-            descripcion,
-            payload,
-            s_sqli,
+            f"[SQLiDetect] IP={client_ip} Score={score:.2f} Desc={all_desc} Campos={list(data.keys())}"
         )
 
-        # Marcar información del ataque para el sistema de auditoría
+        # Guardamos info en request
         request.sql_attack_info = {
             "ip": client_ip,
             "tipos": ["SQLi"],
-            "descripcion": descripcion,
-            "payload": payload,
-            "score": s_sqli,
+            "descripcion": all_desc,
+            "score": round(score, 2),
         }
 
-        return None
+        # Bloqueamos solo si supera umbral de riesgo
+        if score >= 0.7:
+            from django.http import JsonResponse
+            return JsonResponse(
+                {"error": "Posible ataque de inyección SQL detectado. Solicitud bloqueada."},
+                status=403
+            )
 
 
 # =====================================================

{guardianunivalle_benito_yucra-0.1.38.dist-info → guardianunivalle_benito_yucra-0.1.39.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GuardianUnivalle-Benito-Yucra
-Version: 0.1.38
+Version: 0.1.39
 Summary: Middleware y detectores de seguridad (SQLi, XSS, CSRF, DoS, Keylogger) para Django/Flask
 Author-email: Andres Benito Calle Yucra <benitoandrescalle035@gmail.com>
 License: MIT

{guardianunivalle_benito_yucra-0.1.38.dist-info → guardianunivalle_benito_yucra-0.1.39.dist-info}/RECORD

@@ -7,14 +7,14 @@ GuardianUnivalle_Benito_Yucra/criptografia/kdf.py,sha256=_sbepEY1qHEKga0ExrX2WRg
 GuardianUnivalle_Benito_Yucra/detectores/detector_csrf.py,sha256=wt9LRMG9XK4eSSmW91tlGmsJWfyk445b8-n2oxlXlwo,7893
 GuardianUnivalle_Benito_Yucra/detectores/detector_dos.py,sha256=l_JYCmRYpsXt1ZauNPF_wy5uGJhmunRbtJ_WKpC3Otc,6953
 GuardianUnivalle_Benito_Yucra/detectores/detector_keylogger.py,sha256=L5RQ0Sdgg7hTU1qkZYwt7AcDqtAzT6u-jwBGo7YWfsw,8078
-GuardianUnivalle_Benito_Yucra/detectores/detector_sql.py,sha256=o2IXqF3Nbsh5roPihyLal42iCzgxfyX3D6Ef-cxOpVo,6644
+GuardianUnivalle_Benito_Yucra/detectores/detector_sql.py,sha256=QiK4GKWK-Kv98ugziymrVqnJOMqcoKcHBByTbAaSr-Y,4244
 GuardianUnivalle_Benito_Yucra/detectores/detector_xss.py,sha256=Ipw1XXBd1-SsOOhhl9joQGduTq0GhSa61TRTyASF3XE,6795
 GuardianUnivalle_Benito_Yucra/middleware_web/middleware_web.py,sha256=23pLLYqliUoMrIC6ZEwz3hKXeDjWfHSm9vYPWGmDDik,495
 GuardianUnivalle_Benito_Yucra/mitigacion/limitador_peticion.py,sha256=ipMOebYhql-6mSyHs0ddYXOcXq9w8P_IXLlpiIqGncw,246
 GuardianUnivalle_Benito_Yucra/mitigacion/lista_bloqueo.py,sha256=6AYWII4mrmwCLHCvGTyoBxR4Oasr4raSHpFbVjqn7d8,193
 GuardianUnivalle_Benito_Yucra/puntuacion/puntuacion_amenaza.py,sha256=Wx5XfcII4oweLvZsTBEJ7kUc9pMpP5-36RfI5C5KJXo,561
-guardianunivalle_benito_yucra-0.1.38.dist-info/licenses/LICENSE,sha256=5e4IdL542v1E8Ft0A24GZjrxZeTsVK7XrS3mZEUhPtM,37
-guardianunivalle_benito_yucra-0.1.38.dist-info/METADATA,sha256=CmRw1VBfS2v9_CkDrdflpqgkV-4AOr5vIZtEnNnnwPY,1893
-guardianunivalle_benito_yucra-0.1.38.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-guardianunivalle_benito_yucra-0.1.38.dist-info/top_level.txt,sha256=HTWfZM64WAV_QYr5cnXnLuabQt92dvlxqlR3pCwpbDQ,30
-guardianunivalle_benito_yucra-0.1.38.dist-info/RECORD,,
+guardianunivalle_benito_yucra-0.1.39.dist-info/licenses/LICENSE,sha256=5e4IdL542v1E8Ft0A24GZjrxZeTsVK7XrS3mZEUhPtM,37
+guardianunivalle_benito_yucra-0.1.39.dist-info/METADATA,sha256=OPUn0TwR5zL6kpNrPT5Ag_g-BHh9NAClKwt69L8On0g,1893
+guardianunivalle_benito_yucra-0.1.39.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+guardianunivalle_benito_yucra-0.1.39.dist-info/top_level.txt,sha256=HTWfZM64WAV_QYr5cnXnLuabQt92dvlxqlR3pCwpbDQ,30
+guardianunivalle_benito_yucra-0.1.39.dist-info/RECORD,,