GuardianUnivalle-Benito-Yucra 0.1.8__py3-none-any.whl → 0.1.9__py3-none-any.whl

GuardianUnivalle_Benito_Yucra/detectores/detector_sql.py

@@ -5,6 +5,8 @@ import logging
 from typing import Tuple
 from django.http import JsonResponse
 from django.utils.deprecation import MiddlewareMixin
+from django.conf import settings
+from django.core.signing import TimestampSigner, BadSignature, SignatureExpired
 
 # ---------- Configuración de logging ----------
 logger = logging.getLogger("sqlidefense")
@@ -43,6 +45,18 @@ PATTERNS = [
 TEMP_BLOCK = {}  # {ip: timestamp}
 BLOCK_DURATION = 30  # segundos
 
+# ---------- Configuración para bypass ----------
+BYPASS_MAX_AGE = getattr(settings, "SQLI_BYPASS_MAX_AGE", 30)  # segundos
+BYPASS_HEADER = "HTTP_X_SQLI_BYPASS"
+
+# --- JWT soporte (si simplejwt está instalado) ---
+try:
+    from rest_framework_simplejwt.backends import TokenBackend
+
+    SIMPLEJWT_AVAILABLE = True
+except Exception:
+    SIMPLEJWT_AVAILABLE = False
+
 
 # ---------- Helpers ----------
 def extract_payload_text(request) -> str:
@@ -90,6 +104,44 @@ def get_client_ip(request):
     return ip
 
 
+def is_valid_jwt(request) -> bool:
+    """Valida si la petición trae un JWT válido en Authorization: Bearer <token>"""
+    if not SIMPLEJWT_AVAILABLE:
+        return False
+    auth = request.META.get("HTTP_AUTHORIZATION", "")
+    if not auth or not auth.startswith("Bearer "):
+        return False
+    token = auth.split(" ", 1)[1].strip()
+    try:
+        tb = TokenBackend(
+            algorithm=getattr(settings, "SIMPLE_JWT", {}).get("ALGORITHM", "HS256"),
+            signing_key=getattr(settings, "SIMPLE_JWT", {}).get(
+                "SIGNING_KEY", settings.SECRET_KEY
+            ),
+        )
+        tb.decode(token, verify=True)
+        return True
+    except Exception:
+        return False
+
+
+def is_valid_signed_bypass(request) -> bool:
+    """Valida si la petición trae un token firmado válido y no expirado"""
+    signed = request.META.get(BYPASS_HEADER, "")
+    if not signed:
+        return False
+    signer = TimestampSigner(settings.SECRET_KEY)
+    try:
+        signer.unsign(signed, max_age=BYPASS_MAX_AGE)
+        return True
+    except SignatureExpired:
+        logger.info("Bypass token expirado")
+        return False
+    except BadSignature:
+        logger.info("Bypass token inválido")
+        return False
+
+
 # ---------- Middleware ----------
 class SQLIDefenseStrongMiddleware(MiddlewareMixin):
     def process_request(self, request):
@@ -109,6 +161,13 @@ class SQLIDefenseStrongMiddleware(MiddlewareMixin):
             else:
                 del TEMP_BLOCK[client_ip]
 
+        # --- Nuevo: bypass por JWT válido o token firmado válido ---
+        if is_valid_jwt(request):
+            return None
+        if is_valid_signed_bypass(request):
+            return None
+
+        # --- Detección de SQLi ---
         text = extract_payload_text(request)
         if not text:
             return None
@@ -117,11 +176,9 @@ class SQLIDefenseStrongMiddleware(MiddlewareMixin):
         if flagged:
             # Bloquea temporalmente la IP
             TEMP_BLOCK[client_ip] = time.time()
-            # Logging profesional
             logger.warning(
                 f"Intento de ataque detectado desde IP: {client_ip}, detalles: {matches}, payload: {text}"
             )
-
             return JsonResponse(
                 {
                     "detail": "Request bloqueado: posible intento de inyección SQL detectado",

{guardianunivalle_benito_yucra-0.1.8.dist-info → guardianunivalle_benito_yucra-0.1.9.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GuardianUnivalle-Benito-Yucra
-Version: 0.1.8
+Version: 0.1.9
 Summary: Middleware y detectores de seguridad (SQLi, XSS, CSRF, DoS, Keylogger) para Django/Flask
 Author-email: Andres Benito Calle Yucra <benitoandrescalle035@gmail.com>
 License: MIT

{guardianunivalle_benito_yucra-0.1.8.dist-info → guardianunivalle_benito_yucra-0.1.9.dist-info}/RECORD

@@ -7,14 +7,14 @@ GuardianUnivalle_Benito_Yucra/criptografia/kdf.py,sha256=_sbepEY1qHEKga0ExrX2WRg
 GuardianUnivalle_Benito_Yucra/detectores/detector_csrf.py,sha256=EAYfLkHuxGC5rXSu4mZJ4yZDCbwBpTX8xZWGKz7i5wA,692
 GuardianUnivalle_Benito_Yucra/detectores/detector_dos.py,sha256=lMWmCw6nccCEnek53nVjpoBCeiBqLdrSXxqRuI7VP2I,696
 GuardianUnivalle_Benito_Yucra/detectores/detector_keylogger.py,sha256=rEDG-Q_R56OsG2ypfHVBK7erolYjdvATnAxB3yvPXts,729
-GuardianUnivalle_Benito_Yucra/detectores/detector_sql.py,sha256=subkuneu8eXinhKL3jKPdo3bNmrOTkvvZaWWY_BUgbg,4368
+GuardianUnivalle_Benito_Yucra/detectores/detector_sql.py,sha256=BG2XaxgvQK5c6X5Mdz8g4dthuSvC8NMMiDt03MknoJQ,6346
 GuardianUnivalle_Benito_Yucra/detectores/detector_xss.py,sha256=66V_xuxNOZEwluvWOT4-6pk5MJ3zWE1IwcVkBl7MZSg,719
 GuardianUnivalle_Benito_Yucra/middleware_web/middleware_web.py,sha256=23pLLYqliUoMrIC6ZEwz3hKXeDjWfHSm9vYPWGmDDik,495
 GuardianUnivalle_Benito_Yucra/mitigacion/limitador_peticion.py,sha256=ipMOebYhql-6mSyHs0ddYXOcXq9w8P_IXLlpiIqGncw,246
 GuardianUnivalle_Benito_Yucra/mitigacion/lista_bloqueo.py,sha256=6AYWII4mrmwCLHCvGTyoBxR4Oasr4raSHpFbVjqn7d8,193
 GuardianUnivalle_Benito_Yucra/puntuacion/puntuacion_amenaza.py,sha256=Wx5XfcII4oweLvZsTBEJ7kUc9pMpP5-36RfI5C5KJXo,561
-guardianunivalle_benito_yucra-0.1.8.dist-info/licenses/LICENSE,sha256=5e4IdL542v1E8Ft0A24GZjrxZeTsVK7XrS3mZEUhPtM,37
-guardianunivalle_benito_yucra-0.1.8.dist-info/METADATA,sha256=YgoyLWRreSyNHLPx-oinGqAknNtwgZhBLhyfo5nqkIM,1892
-guardianunivalle_benito_yucra-0.1.8.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-guardianunivalle_benito_yucra-0.1.8.dist-info/top_level.txt,sha256=HTWfZM64WAV_QYr5cnXnLuabQt92dvlxqlR3pCwpbDQ,30
-guardianunivalle_benito_yucra-0.1.8.dist-info/RECORD,,
+guardianunivalle_benito_yucra-0.1.9.dist-info/licenses/LICENSE,sha256=5e4IdL542v1E8Ft0A24GZjrxZeTsVK7XrS3mZEUhPtM,37
+guardianunivalle_benito_yucra-0.1.9.dist-info/METADATA,sha256=PxiYZRLFPPf_PRvcBC_PmfPt-IYkGAMQSUqB0df89_g,1892
+guardianunivalle_benito_yucra-0.1.9.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+guardianunivalle_benito_yucra-0.1.9.dist-info/top_level.txt,sha256=HTWfZM64WAV_QYr5cnXnLuabQt92dvlxqlR3pCwpbDQ,30
+guardianunivalle_benito_yucra-0.1.9.dist-info/RECORD,,