GuardianUnivalle-Benito-Yucra 0.1.38__py3-none-any.whl → 0.1.40__py3-none-any.whl

GuardianUnivalle_Benito_Yucra/detectores/detector_sql.py

@@ -1,15 +1,12 @@
 # sql_defense.py
-from __future__ import annotations
+# GuardianUnivalle_Benito_Yucra/detectores/detector_sql.py
+
 import json
 import logging
 import re
-from typing import List, Tuple
-from django.conf import settings
 from django.utils.deprecation import MiddlewareMixin
+from django.conf import settings
 
-# =====================================================
-# ===             CONFIGURACIÓN DEL LOGGER           ===
-# =====================================================
 logger = logging.getLogger("sqlidefense")
 logger.setLevel(logging.INFO)
 if not logger.handlers:
@@ -17,50 +14,34 @@ if not logger.handlers:
     handler.setFormatter(logging.Formatter("%(asctime)s - %(levelname)s - %(message)s"))
     logger.addHandler(handler)
 
-
 # =====================================================
-# ===        PATRONES DE DETECCIÓN DE SQLi           ===
+# ===        PATRONES DE ATAQUE SQL DEFINIDOS       ===
 # =====================================================
-SQLI_PATTERNS: List[Tuple[re.Pattern, str]] = [
-    # Inyección clásica con UNION SELECT
-    (re.compile(r"\bunion\b\s+(all\s+)?\bselect\b", re.I), "Uso de UNION SELECT"),
-    # Combinaciones OR/AND en consultas WHERE
-    (
-        re.compile(r"\bselect\b.*\bfrom\b.*\bwhere\b.*\b(or|and)\b.*=", re.I),
-        "SELECT con OR/AND",
-    ),
-    # Comparaciones tautológicas (1=1)
-    (
-        re.compile(r"\b(or|and)\s+\d+\s*=\s*\d+", re.I),
-        "Expresión tautológica OR/AND 1=1",
-    ),
-    # Manipulación de tablas
-    (
-        re.compile(r"\b(drop|truncate|delete|insert|update)\b", re.I),
-        "Comando de manipulación de tabla",
-    ),
-    # Comentarios sospechosos o terminadores
-    (re.compile(r"(--|#|;)", re.I), "Comentario o terminador sospechoso"),
-    # Ejecución directa de procedimientos
-    (re.compile(r"exec\s*\(", re.I), "Ejecución de procedimiento almacenado"),
-    # Subconsultas y SELECT anidados sospechosos
-    (re.compile(r"\(\s*select\b.*\)", re.I), "Subconsulta sospechosa"),
+SQL_PATTERNS = [
+    (re.compile(r"\bunion\b\s+(all\s+)?\bselect\b", re.I), "Uso de UNION SELECT", 0.7),
+    (re.compile(r"\bor\b\s+'?\d+'?\s*=\s*'?\d+'?", re.I), "Tautología OR 1=1", 0.6),
+    (re.compile(r"\bselect\b.+\bfrom\b", re.I), "Consulta SQL SELECT-FROM", 0.5),
+    (re.compile(r"(--|#|/\*|\*/)", re.I), "Comentario SQL sospechoso", 0.4),
+    (re.compile(r"\b(drop|truncate|delete|insert|update)\b", re.I), "Manipulación SQL", 0.5),
+    (re.compile(r"exec\s*\(", re.I), "Ejecución de procedimiento almacenado", 0.6),
 ]
 
+IGNORED_FIELDS = ["password", "csrfmiddlewaretoken", "token", "auth"]
 
-# =====================================================
-# ===          FUNCIONES AUXILIARES SQLi             ===
-# =====================================================
-def extract_payload_text(request) -> str:
-    """
-    Extrae texto de interés desde el cuerpo, querystring,
-    encabezados y referencias para analizar posible SQLi.
-    """
-    parts: List[str] = []
 
+def get_client_ip(request):
+    """Obtiene la IP real del cliente."""
+    x_forwarded_for = request.META.get("HTTP_X_FORWARDED_FOR")
+    if x_forwarded_for:
+        return x_forwarded_for.split(",")[0].strip()
+    return request.META.get("REMOTE_ADDR", "")
+
+
+def extract_payload(request):
+    """Extrae datos útiles de la solicitud para análisis."""
+    parts = []
     try:
-        content_type = request.META.get("CONTENT_TYPE", "")
-        if "application/json" in content_type:
+        if "application/json" in request.META.get("CONTENT_TYPE", ""):
             data = json.loads(request.body.decode("utf-8") or "{}")
             parts.append(json.dumps(data))
         else:
@@ -74,94 +55,53 @@ def extract_payload_text(request) -> str:
     if qs:
         parts.append(qs)
 
-    parts.append(request.META.get("HTTP_USER_AGENT", ""))
-    parts.append(request.META.get("HTTP_REFERER", ""))
-
-    return " ".join([p for p in parts if p])
+    return " ".join(parts)
 
 
-def detect_sql_attack(text: str) -> Tuple[bool, List[str]]:
-    """
-    Recorre el texto buscando patrones típicos de inyección SQL.
-    Retorna (True, lista_de_descripciones) si se detecta algún patrón.
-    """
-    descripcion: List[str] = []
+def detect_sql_injection(value):
+    """Detecta patrones sospechosos en una cadena."""
+    score = 0.0
+    descripciones = []
+    for pattern, desc, weight in SQL_PATTERNS:
+        if pattern.search(value):
+            score += weight
+            descripciones.append(desc)
+    return score, descripciones
 
-    for patt, msg in SQLI_PATTERNS:
-        if patt.search(text):
-            descripcion.append(msg)
-
-    return (len(descripcion) > 0, descripcion)
-
-
-def get_client_ip(request) -> str:
-    """
-    Obtiene la IP real del cliente considerando X-Forwarded-For.
-    """
-    x_forwarded_for = request.META.get("HTTP_X_FORWARDED_FOR")
-    if x_forwarded_for:
-        return x_forwarded_for.split(",")[0].strip()
-    return request.META.get("REMOTE_ADDR", "")
-
-
-# =====================================================
-# ===          MIDDLEWARE DE DEFENSA SQLi            ===
-# =====================================================
 class SQLIDefenseMiddleware(MiddlewareMixin):
-    """
-    Middleware profesional de detección de inyección SQL.
-    - Detecta patrones en parámetros, cuerpo y cabeceras.
-    - No bloquea directamente; marca el intento para auditoría.
-    """
+    """Middleware de detección SQL Injection."""
 
     def process_request(self, request):
-        # ---------------------------------------------
-        # 1. Filtrar IPs confiables
-        # ---------------------------------------------
         client_ip = get_client_ip(request)
-        trusted_ips: List[str] = getattr(settings, "SQLI_DEFENSE_TRUSTED_IPS", [])
+        trusted_ips = getattr(settings, "SQLI_DEFENSE_TRUSTED_IPS", [])
+        trusted_urls = getattr(settings, "SQLI_DEFENSE_TRUSTED_URLS", [])
+
+        # Ignorar si la IP es confiable
         if client_ip in trusted_ips:
             return None
 
-        # ---------------------------------------------
-        # 2. Extraer payload de la solicitud
-        # ---------------------------------------------
-        payload = extract_payload_text(request)
-        if not payload:
+        # Ignorar si la URL de referencia (Referer) o Host está en la lista de URLs confiables
+        referer = request.META.get("HTTP_REFERER", "")
+        host = request.get_host()
+        if any(url in referer for url in trusted_urls) or any(url in host for url in trusted_urls):
             return None
 
-        # ---------------------------------------------
-        # 3. Analizar contenido en busca de patrones SQLi
-        # ---------------------------------------------
-        flagged, descripcion = detect_sql_attack(payload)
-        if not flagged:
-            return None
+        payload = extract_payload(request)
+        score, descripciones = detect_sql_injection(payload)
 
-        # ---------------------------------------------
-        # 4. Calcular puntaje de amenaza S_sqli
-        # ---------------------------------------------
-        w_sqli = getattr(settings, "SQLI_DEFENSE_WEIGHT", 0.4)
-        detecciones_sqli = len(descripcion)
-        s_sqli = w_sqli * detecciones_sqli
+        if score == 0:
+            return None
 
-        # ---------------------------------------------
-        # 5. Registrar e informar el intento
-        # ---------------------------------------------
         logger.warning(
-            "Inyección SQL detectada desde IP %s: %s ; payload: %.200s ; score: %.2f",
-            client_ip,
-            descripcion,
-            payload,
-            s_sqli,
+            f"[SQLiDetect] IP={client_ip} Score={score:.2f} Desc={descripciones} Payload={payload[:200]}"
         )
 
-        # Marcar información del ataque para el sistema de auditoría
         request.sql_attack_info = {
             "ip": client_ip,
             "tipos": ["SQLi"],
-            "descripcion": descripcion,
-            "payload": payload,
-            "score": s_sqli,
+            "descripcion": descripciones,
+            "payload": payload[:500],
+            "score": round(score, 2),
         }
 
         return None

{guardianunivalle_benito_yucra-0.1.38.dist-info → guardianunivalle_benito_yucra-0.1.40.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GuardianUnivalle-Benito-Yucra
-Version: 0.1.38
+Version: 0.1.40
 Summary: Middleware y detectores de seguridad (SQLi, XSS, CSRF, DoS, Keylogger) para Django/Flask
 Author-email: Andres Benito Calle Yucra <benitoandrescalle035@gmail.com>
 License: MIT

{guardianunivalle_benito_yucra-0.1.38.dist-info → guardianunivalle_benito_yucra-0.1.40.dist-info}/RECORD

@@ -7,14 +7,14 @@ GuardianUnivalle_Benito_Yucra/criptografia/kdf.py,sha256=_sbepEY1qHEKga0ExrX2WRg
 GuardianUnivalle_Benito_Yucra/detectores/detector_csrf.py,sha256=wt9LRMG9XK4eSSmW91tlGmsJWfyk445b8-n2oxlXlwo,7893
 GuardianUnivalle_Benito_Yucra/detectores/detector_dos.py,sha256=l_JYCmRYpsXt1ZauNPF_wy5uGJhmunRbtJ_WKpC3Otc,6953
 GuardianUnivalle_Benito_Yucra/detectores/detector_keylogger.py,sha256=L5RQ0Sdgg7hTU1qkZYwt7AcDqtAzT6u-jwBGo7YWfsw,8078
-GuardianUnivalle_Benito_Yucra/detectores/detector_sql.py,sha256=o2IXqF3Nbsh5roPihyLal42iCzgxfyX3D6Ef-cxOpVo,6644
+GuardianUnivalle_Benito_Yucra/detectores/detector_sql.py,sha256=hdiRuIJy5Dg4Gq8PP7UmsA4eRzIF-J02HFRLCtGLyY8,4391
 GuardianUnivalle_Benito_Yucra/detectores/detector_xss.py,sha256=Ipw1XXBd1-SsOOhhl9joQGduTq0GhSa61TRTyASF3XE,6795
 GuardianUnivalle_Benito_Yucra/middleware_web/middleware_web.py,sha256=23pLLYqliUoMrIC6ZEwz3hKXeDjWfHSm9vYPWGmDDik,495
 GuardianUnivalle_Benito_Yucra/mitigacion/limitador_peticion.py,sha256=ipMOebYhql-6mSyHs0ddYXOcXq9w8P_IXLlpiIqGncw,246
 GuardianUnivalle_Benito_Yucra/mitigacion/lista_bloqueo.py,sha256=6AYWII4mrmwCLHCvGTyoBxR4Oasr4raSHpFbVjqn7d8,193
 GuardianUnivalle_Benito_Yucra/puntuacion/puntuacion_amenaza.py,sha256=Wx5XfcII4oweLvZsTBEJ7kUc9pMpP5-36RfI5C5KJXo,561
-guardianunivalle_benito_yucra-0.1.38.dist-info/licenses/LICENSE,sha256=5e4IdL542v1E8Ft0A24GZjrxZeTsVK7XrS3mZEUhPtM,37
-guardianunivalle_benito_yucra-0.1.38.dist-info/METADATA,sha256=CmRw1VBfS2v9_CkDrdflpqgkV-4AOr5vIZtEnNnnwPY,1893
-guardianunivalle_benito_yucra-0.1.38.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-guardianunivalle_benito_yucra-0.1.38.dist-info/top_level.txt,sha256=HTWfZM64WAV_QYr5cnXnLuabQt92dvlxqlR3pCwpbDQ,30
-guardianunivalle_benito_yucra-0.1.38.dist-info/RECORD,,
+guardianunivalle_benito_yucra-0.1.40.dist-info/licenses/LICENSE,sha256=5e4IdL542v1E8Ft0A24GZjrxZeTsVK7XrS3mZEUhPtM,37
+guardianunivalle_benito_yucra-0.1.40.dist-info/METADATA,sha256=ue2VCRiG_RztWsCO7HprHZegV6iwBeOVDJDnT-mm844,1893
+guardianunivalle_benito_yucra-0.1.40.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+guardianunivalle_benito_yucra-0.1.40.dist-info/top_level.txt,sha256=HTWfZM64WAV_QYr5cnXnLuabQt92dvlxqlR3pCwpbDQ,30
+guardianunivalle_benito_yucra-0.1.40.dist-info/RECORD,,