GuardianUnivalle-Benito-Yucra 0.1.4__tar.gz → 0.1.6__tar.gz

guardianunivalle_benito_yucra-0.1.6/GuardianUnivalle_Benito_Yucra/detectores/detector_sql.py

@@ -0,0 +1,113 @@
+import re
+import json
+import time
+from typing import Tuple
+from django.http import JsonResponse
+from django.utils.deprecation import MiddlewareMixin
+
+# ---------- Patrones de ataques SQL ----------
+PATTERNS = [
+    (
+        re.compile(r"\bunion\b\s+(all\s+)?\bselect\b", re.I),
+        "Intento de UNION SELECT detectado",
+    ),
+    (
+        re.compile(r"\bselect\b.*\bfrom\b.*\bwhere\b.*\b(or|and)\b.*=", re.I),
+        "Intento de SELECT con OR/AND detectado",
+    ),
+    (
+        re.compile(r"\b(or|and)\s+\d+\s*=\s*\d+", re.I),
+        "Intento de OR/AND 1=1 detectado",
+    ),
+    (
+        re.compile(r"\b(drop|truncate|delete|insert|update)\b", re.I),
+        "Intento de manipulación de tabla detectado",
+    ),
+    (
+        re.compile(r"(--|#|;)", re.I),
+        "Comentario o terminador de sentencia sospechoso detectado",
+    ),
+    (re.compile(r"exec\s*\(", re.I), "Intento de ejecución de procedimiento detectado"),
+]
+
+# ---------- Bloqueo temporal por IP ----------
+TEMP_BLOCK = {}  # {ip: timestamp}
+BLOCK_DURATION = 30  # segundos
+
+
+# ---------- Helpers ----------
+def extract_payload_text(request) -> str:
+    """Extrae todo el contenido que podría contener inyecciones"""
+    parts = []
+    # Query params
+    if request.META.get("QUERY_STRING"):
+        parts.append(request.META.get("QUERY_STRING"))
+    # Body
+    try:
+        content_type = request.META.get("CONTENT_TYPE", "")
+        if "application/json" in content_type:
+            body_json = json.loads(request.body.decode("utf-8") or "{}")
+            parts.append(json.dumps(body_json))
+        else:
+            parts.append(request.body.decode("utf-8", errors="ignore"))
+    except Exception:
+        pass
+    # Headers
+    parts.append(request.META.get("HTTP_USER_AGENT", ""))
+    parts.append(request.META.get("HTTP_REFERER", ""))
+    return " ".join([p for p in parts if p])
+
+
+def detect_sqli_text(text: str) -> Tuple[bool, list]:
+    """Detecta ataques SQL en el texto"""
+    matches = []
+    for patt, message in PATTERNS:
+        if patt.search(text):
+            matches.append(message)
+    return (len(matches) > 0, matches)
+
+
+def get_client_ip(request):
+    """Obtiene la IP del cliente"""
+    x_forwarded_for = request.META.get("HTTP_X_FORWARDED_FOR")
+    if x_forwarded_for:
+        ip = x_forwarded_for.split(",")[0]
+    else:
+        ip = request.META.get("REMOTE_ADDR")
+    return ip
+
+
+# ---------- Middleware ----------
+class SQLIDefenseStrongMiddleware(MiddlewareMixin):
+    def process_request(self, request):
+        client_ip = get_client_ip(request)
+
+        # Revisa si la IP está temporalmente bloqueada
+        if client_ip in TEMP_BLOCK:
+            if time.time() - TEMP_BLOCK[client_ip] < BLOCK_DURATION:
+                return JsonResponse(
+                    {
+                        "detail": "Acceso temporalmente bloqueado por actividad sospechosa",
+                        "alerts": ["IP bloqueada temporalmente"],
+                    },
+                    status=403,
+                )
+            else:
+                del TEMP_BLOCK[client_ip]
+
+        text = extract_payload_text(request)
+        if not text:
+            return None
+
+        flagged, matches = detect_sqli_text(text)
+        if flagged:
+            # Bloquea temporalmente la IP
+            TEMP_BLOCK[client_ip] = time.time()
+            return JsonResponse(
+                {
+                    "detail": "Request bloqueado: posible intento de inyección SQL detectado",
+                    "alerts": matches,
+                },
+                status=403,
+            )
+        return None

{guardianunivalle_benito_yucra-0.1.4 → guardianunivalle_benito_yucra-0.1.6}/GuardianUnivalle_Benito_Yucra.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GuardianUnivalle-Benito-Yucra
-Version: 0.1.4
+Version: 0.1.6
 Summary: Middleware y detectores de seguridad (SQLi, XSS, CSRF, DoS, Keylogger) para Django/Flask
 Author-email: Andres Benito Calle Yucra <benitoandrescalle035@gmail.com>
 License: MIT

{guardianunivalle_benito_yucra-0.1.4 → guardianunivalle_benito_yucra-0.1.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GuardianUnivalle-Benito-Yucra
-Version: 0.1.4
+Version: 0.1.6
 Summary: Middleware y detectores de seguridad (SQLi, XSS, CSRF, DoS, Keylogger) para Django/Flask
 Author-email: Andres Benito Calle Yucra <benitoandrescalle035@gmail.com>
 License: MIT

{guardianunivalle_benito_yucra-0.1.4 → guardianunivalle_benito_yucra-0.1.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "GuardianUnivalle-Benito-Yucra"  # usar mayúsculas consistente
-version = "0.1.4"
+version = "0.1.6"
 description = "Middleware y detectores de seguridad (SQLi, XSS, CSRF, DoS, Keylogger) para Django/Flask"
 authors = [
     { name = "Andres Benito Calle Yucra", email = "benitoandrescalle035@gmail.com" }

guardianunivalle_benito_yucra-0.1.4/GuardianUnivalle_Benito_Yucra/detectores/detector_sql.py

@@ -1,89 +0,0 @@
-# middleware_sql_defense.py
-import re
-import json
-from typing import Tuple
-from django.http import JsonResponse
-from django.utils.deprecation import MiddlewareMixin
-
-# ---------- Patrones y normalización ----------
-_literal_single = re.compile(r"'([^'\\]|\\.)*'")
-_literal_double = re.compile(r'"([^"\\]|\\.)*"')
-_comment_sql = re.compile(r"(--[^\n]*|/\*.*?\*/)", re.S)
-
-PATTERNS = [
-    (re.compile(r"\bunion\b\s+(all\s+)?\bselect\b", re.I), 0.95),
-    (re.compile(r"(?<!\w)or(?=\s+1=1)", re.I), 0.99),
-    (re.compile(r"\b(select\b.*\bfrom\b.*\bwhere\b.*\b(or|and)\b.*=)", re.I), 0.7),
-    (re.compile(r"\b(drop|truncate|delete|insert|update)\b", re.I), 0.8),
-    (re.compile(r"(--|#|;)", re.I), 0.4),
-]
-
-
-# ---------- Helpers ----------
-def normalize_text(s: str) -> str:
-    """Quita literales y comentarios para reducir falsos positivos"""
-    if not s:
-        return ""
-    s = _comment_sql.sub(" ", s)
-    s = _literal_single.sub("''", s)
-    s = _literal_double.sub('""', s)
-    s = re.sub(r"\s+", " ", s).strip()
-    return s
-
-
-def extract_payload_text(request) -> str:
-    """Extrae texto potencialmente peligroso del request"""
-    parts = []
-    try:
-        # query params
-        if request.META.get("QUERY_STRING"):
-            parts.append(request.META.get("QUERY_STRING"))
-        # body
-        content_type = request.META.get("CONTENT_TYPE", "")
-        if "application/json" in content_type:
-            try:
-                body_json = json.loads(request.body.decode("utf-8") or "{}")
-                parts.append(json.dumps(body_json))
-            except Exception:
-                parts.append((request.body or b"").decode("utf-8", errors="ignore"))
-        else:
-            try:
-                parts.append(request.body.decode("utf-8", errors="ignore"))
-            except Exception:
-                pass
-        # headers sospechosos
-        parts.append(request.META.get("HTTP_USER_AGENT", ""))
-        parts.append(request.META.get("HTTP_REFERER", ""))
-    except Exception:
-        pass
-    return " ".join([p for p in parts if p])
-
-
-def detect_sqli_text(text: str) -> Tuple[bool, list]:
-    """Detecta patrones en un texto normalizado"""
-    q = normalize_text(text)
-    matches = []
-    for patt, sev in PATTERNS:
-        if patt.search(q):
-            matches.append((patt.pattern, float(sev)))
-    return (len(matches) > 0, matches)
-
-
-# ---------- Middleware ----------
-class SQLIDefenseMiddleware(MiddlewareMixin):
-    def process_request(self, request):
-        text = extract_payload_text(request)
-        if not text:
-            return None
-
-        flagged, matches = detect_sqli_text(text)
-        if flagged:
-            # Bloqueo inmediato solo para pruebas
-            return JsonResponse(
-                {
-                    "detail": "Request bloqueado: posible inyección SQL detectada",
-                    "matches": matches,
-                },
-                status=403,
-            )
-        return None