GuardianUnivalle-Benito-Yucra 0.1.7__tar.gz → 0.1.9__tar.gz

{guardianunivalle_benito_yucra-0.1.7 → guardianunivalle_benito_yucra-0.1.9}/GuardianUnivalle_Benito_Yucra/detectores/detector_sql.py

@@ -1,9 +1,20 @@
 import re
 import json
 import time
+import logging
 from typing import Tuple
 from django.http import JsonResponse
 from django.utils.deprecation import MiddlewareMixin
+from django.conf import settings
+from django.core.signing import TimestampSigner, BadSignature, SignatureExpired
+
+# ---------- Configuración de logging ----------
+logger = logging.getLogger("sqlidefense")
+logger.setLevel(logging.INFO)
+handler = logging.StreamHandler()  # Por consola; en producción puede ser FileHandler
+formatter = logging.Formatter("%(asctime)s - %(levelname)s - %(message)s")
+handler.setFormatter(formatter)
+logger.addHandler(handler)
 
 # ---------- Patrones de ataques SQL ----------
 PATTERNS = [
@@ -34,14 +45,28 @@ PATTERNS = [
 TEMP_BLOCK = {}  # {ip: timestamp}
 BLOCK_DURATION = 30  # segundos
 
+# ---------- Configuración para bypass ----------
+BYPASS_MAX_AGE = getattr(settings, "SQLI_BYPASS_MAX_AGE", 30)  # segundos
+BYPASS_HEADER = "HTTP_X_SQLI_BYPASS"
+
+# --- JWT soporte (si simplejwt está instalado) ---
+try:
+    from rest_framework_simplejwt.backends import TokenBackend
+
+    SIMPLEJWT_AVAILABLE = True
+except Exception:
+    SIMPLEJWT_AVAILABLE = False
+
 
 # ---------- Helpers ----------
 def extract_payload_text(request) -> str:
     """Extrae todo el contenido que podría contener inyecciones"""
     parts = []
+
     # Query params
     if request.META.get("QUERY_STRING"):
         parts.append(request.META.get("QUERY_STRING"))
+
     # Body
     try:
         content_type = request.META.get("CONTENT_TYPE", "")
@@ -52,9 +77,11 @@ def extract_payload_text(request) -> str:
             parts.append(request.body.decode("utf-8", errors="ignore"))
     except Exception:
         pass
+
     # Headers
     parts.append(request.META.get("HTTP_USER_AGENT", ""))
     parts.append(request.META.get("HTTP_REFERER", ""))
+
     return " ".join([p for p in parts if p])
 
 
@@ -71,12 +98,50 @@ def get_client_ip(request):
     """Obtiene la IP del cliente"""
     x_forwarded_for = request.META.get("HTTP_X_FORWARDED_FOR")
     if x_forwarded_for:
-        ip = x_forwarded_for.split(",")[0]
+        ip = x_forwarded_for.split(",")[0].strip()
     else:
-        ip = request.META.get("REMOTE_ADDR")
+        ip = request.META.get("REMOTE_ADDR", "0.0.0.0")
     return ip
 
 
+def is_valid_jwt(request) -> bool:
+    """Valida si la petición trae un JWT válido en Authorization: Bearer <token>"""
+    if not SIMPLEJWT_AVAILABLE:
+        return False
+    auth = request.META.get("HTTP_AUTHORIZATION", "")
+    if not auth or not auth.startswith("Bearer "):
+        return False
+    token = auth.split(" ", 1)[1].strip()
+    try:
+        tb = TokenBackend(
+            algorithm=getattr(settings, "SIMPLE_JWT", {}).get("ALGORITHM", "HS256"),
+            signing_key=getattr(settings, "SIMPLE_JWT", {}).get(
+                "SIGNING_KEY", settings.SECRET_KEY
+            ),
+        )
+        tb.decode(token, verify=True)
+        return True
+    except Exception:
+        return False
+
+
+def is_valid_signed_bypass(request) -> bool:
+    """Valida si la petición trae un token firmado válido y no expirado"""
+    signed = request.META.get(BYPASS_HEADER, "")
+    if not signed:
+        return False
+    signer = TimestampSigner(settings.SECRET_KEY)
+    try:
+        signer.unsign(signed, max_age=BYPASS_MAX_AGE)
+        return True
+    except SignatureExpired:
+        logger.info("Bypass token expirado")
+        return False
+    except BadSignature:
+        logger.info("Bypass token inválido")
+        return False
+
+
 # ---------- Middleware ----------
 class SQLIDefenseStrongMiddleware(MiddlewareMixin):
     def process_request(self, request):
@@ -85,6 +150,7 @@ class SQLIDefenseStrongMiddleware(MiddlewareMixin):
         # Revisa si la IP está temporalmente bloqueada
         if client_ip in TEMP_BLOCK:
             if time.time() - TEMP_BLOCK[client_ip] < BLOCK_DURATION:
+                logger.warning(f"IP bloqueada temporalmente: {client_ip}")
                 return JsonResponse(
                     {
                         "detail": "Acceso temporalmente bloqueado por actividad sospechosa",
@@ -95,6 +161,13 @@ class SQLIDefenseStrongMiddleware(MiddlewareMixin):
             else:
                 del TEMP_BLOCK[client_ip]
 
+        # --- Nuevo: bypass por JWT válido o token firmado válido ---
+        if is_valid_jwt(request):
+            return None
+        if is_valid_signed_bypass(request):
+            return None
+
+        # --- Detección de SQLi ---
         text = extract_payload_text(request)
         if not text:
             return None
@@ -103,14 +176,8 @@ class SQLIDefenseStrongMiddleware(MiddlewareMixin):
         if flagged:
             # Bloquea temporalmente la IP
             TEMP_BLOCK[client_ip] = time.time()
-            # <-- Aquí puedes agregar la impresión o el log -->
-            print("IP detectada:", client_ip)
-            # O usando logging
-            import logging
-
-            logger = logging.getLogger(__name__)
             logger.warning(
-                f"Intento de ataque detectado desde IP: {client_ip}, detalles: {matches}"
+                f"Intento de ataque detectado desde IP: {client_ip}, detalles: {matches}, payload: {text}"
             )
             return JsonResponse(
                 {
@@ -119,4 +186,5 @@ class SQLIDefenseStrongMiddleware(MiddlewareMixin):
                 },
                 status=403,
             )
+
         return None

{guardianunivalle_benito_yucra-0.1.7 → guardianunivalle_benito_yucra-0.1.9}/GuardianUnivalle_Benito_Yucra.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GuardianUnivalle-Benito-Yucra
-Version: 0.1.7
+Version: 0.1.9
 Summary: Middleware y detectores de seguridad (SQLi, XSS, CSRF, DoS, Keylogger) para Django/Flask
 Author-email: Andres Benito Calle Yucra <benitoandrescalle035@gmail.com>
 License: MIT

{guardianunivalle_benito_yucra-0.1.7 → guardianunivalle_benito_yucra-0.1.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GuardianUnivalle-Benito-Yucra
-Version: 0.1.7
+Version: 0.1.9
 Summary: Middleware y detectores de seguridad (SQLi, XSS, CSRF, DoS, Keylogger) para Django/Flask
 Author-email: Andres Benito Calle Yucra <benitoandrescalle035@gmail.com>
 License: MIT

{guardianunivalle_benito_yucra-0.1.7 → guardianunivalle_benito_yucra-0.1.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "GuardianUnivalle-Benito-Yucra"  # usar mayúsculas consistente
-version = "0.1.7"
+version = "0.1.9"
 description = "Middleware y detectores de seguridad (SQLi, XSS, CSRF, DoS, Keylogger) para Django/Flask"
 authors = [
     { name = "Andres Benito Calle Yucra", email = "benitoandrescalle035@gmail.com" }