aiwaf 0.1.9.2.3__py3-none-any.whl → 0.1.9.2.5__py3-none-any.whl

aiwaf/__init__.py

@@ -1,6 +1,6 @@
 default_app_config = "aiwaf.apps.AiwafConfig"
 
-__version__ = "0.1.9.2.3"
+__version__ = "0.1.9.2.5"
 
 # Note: Middleware classes are available from aiwaf.middleware
 # Import them only when needed to avoid circular imports during Django app loading

aiwaf/middleware.py

@@ -179,17 +179,26 @@ class IPAndKeywordBlockMiddleware:
             def extract_from_pattern(pattern, prefix=""):
                 try:
                     if isinstance(pattern, URLResolver):
-                        # Handle include() patterns
+                        # Handle include() patterns - be permissive for URL prefixes that route to apps
                         namespace = getattr(pattern, 'namespace', None)
                         if namespace:
                             for segment in re.split(r'[._-]', namespace.lower()):
                                 if len(segment) > 2:
                                     keywords.add(segment)
                         
-                        # Extract from the pattern itself
+                        # Extract from the pattern itself - improved logic for include() patterns
                         pattern_str = str(pattern.pattern)
-                        for segment in re.findall(r'([a-zA-Z]\w{2,})', pattern_str):
-                            keywords.add(segment.lower())
+                        # Get literal path segments (not regex parts)
+                        literal_parts = re.findall(r'([a-zA-Z][a-zA-Z0-9_-]*)', pattern_str)
+                        
+                        # For include() patterns, be more permissive since they're routing to existing apps
+                        # The key insight: if someone includes an app's URLs, the prefix is legitimate by design
+                        for part in literal_parts:
+                            if len(part) > 2:
+                                part_lower = part.lower()
+                                # For URLResolver (include patterns), be more permissive
+                                # These are URL prefixes that route to actual app functionality
+                                keywords.add(part_lower)
                         
                         # Recurse into nested patterns
                         for nested_pattern in pattern.url_patterns:
@@ -578,10 +587,24 @@ class AIAnomalyMiddleware(MiddlewareMixin):
         data = [d for d in data if now - d[0] < self.WINDOW]
         cache.set(key, data, timeout=self.WINDOW)
         
-        keyword_store = get_keyword_store()
-        for seg in re.split(r"\W+", request.path.lower()):
-            if len(seg) > 3:
-                keyword_store.add_keyword(seg)
+        data.append((now, request.path, response.status_code, resp_time))
+        data = [d for d in data if now - d[0] < self.WINDOW]
+        cache.set(key, data, timeout=self.WINDOW)
+        
+        # Only learn keywords from error responses and non-existent paths
+        # This prevents learning legitimate keywords from successful requests
+        if (response.status_code >= 400 and not known_path and not is_exempt_path(request.path)):
+            keyword_store = get_keyword_store()
+            # Get legitimate keywords to avoid learning them
+            from .trainer import get_legitimate_keywords
+            legitimate_keywords = get_legitimate_keywords()
+            
+            for seg in re.split(r"\W+", request.path.lower()):
+                if (len(seg) > 3 and 
+                    seg not in STATIC_KW and  # Don't re-learn static keywords
+                    seg not in legitimate_keywords and  # Don't learn legitimate keywords
+                    self._is_malicious_context(request, seg)):  # Only learn in malicious context
+                    keyword_store.add_keyword(seg)
 
         return response
 

aiwaf/trainer.py

@@ -198,20 +198,37 @@ def _extract_django_route_keywords() -> set:
         def extract_from_pattern(pattern, prefix=""):
             try:
                 if isinstance(pattern, URLResolver):
-                    # Handle include() patterns
+                    # Handle include() patterns - check if they include legitimate apps
                     namespace = getattr(pattern, 'namespace', None)
                     if namespace:
                         for segment in re.split(r'[._-]', namespace.lower()):
                             if len(segment) > 2:
                                 keywords.add(segment)
                     
-                    # Extract from the pattern itself - more comprehensive
+                    # Extract from the pattern itself - improved logic for include() patterns
                     pattern_str = str(pattern.pattern)
                     # Get literal path segments (not regex parts)
                     literal_parts = re.findall(r'([a-zA-Z][a-zA-Z0-9_-]*)', pattern_str)
+                    
+                    # Get list of actual Django app names to validate against
+                    app_names = set()
+                    for app_config in apps.get_app_configs():
+                        app_parts = app_config.name.lower().replace('-', '_').split('.')
+                        for part in app_parts:
+                            for segment in re.split(r'[._-]', part):
+                                if len(segment) > 2:
+                                    app_names.add(segment)
+                        if app_config.label:
+                            app_names.add(app_config.label.lower())
+                    
+                    # For include() patterns, be more permissive since they're routing to existing apps
+                    # The key insight: if someone includes an app's URLs, the prefix is legitimate by design
                     for part in literal_parts:
                         if len(part) > 2:
-                            keywords.add(part.lower())
+                            part_lower = part.lower()
+                            # For URLResolver (include patterns), be more permissive
+                            # These are URL prefixes that route to actual app functionality
+                            keywords.add(part_lower)
                     
                     # Recurse into nested patterns
                     try:

{aiwaf-0.1.9.2.3.dist-info → aiwaf-0.1.9.2.5.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aiwaf
-Version: 0.1.9.2.3
+Version: 0.1.9.2.5
 Summary: AI-powered Web Application Firewall
 Home-page: https://github.com/aayushgauba/aiwaf
 Author: Aayush Gauba

{aiwaf-0.1.9.2.3.dist-info → aiwaf-0.1.9.2.5.dist-info}/RECORD

@@ -1,12 +1,12 @@
-aiwaf/__init__.py,sha256=oJ3sGVirmahdoT5DpCTp_liJkyeRv9FllrYYKRkThnU,220
+aiwaf/__init__.py,sha256=0cr5WYpPFupra8Xms3_swtRbJDdZ3pYEjAnRaRSguIA,220
 aiwaf/apps.py,sha256=nCez-Ptlv2kaEk5HenA8b1pATz1VfhrHP1344gwcY1A,142
 aiwaf/blacklist_manager.py,sha256=LYCeKFB-7e_C6Bg2WeFJWFIIQlrfRMPuGp30ivrnhQY,1196
 aiwaf/decorators.py,sha256=IUKOdM_gdroffImRZep1g1wT6gNqD10zGwcp28hsJCs,825
-aiwaf/middleware.py,sha256=-w_uOaZgakFoJkvmJUB7atqcYQr3nSd9HbSKlP8_178,30370
+aiwaf/middleware.py,sha256=KW982p1eZ3hJYiR0lidomImkB5_J9uhfgCLzsMt53MI,32048
 aiwaf/middleware_logger.py,sha256=LWZVDAnjh6CGESirA8eMbhGgJKB7lVDGRQqVroH95Lo,4742
 aiwaf/models.py,sha256=vQxgY19BDVMjoO903UNrTZC1pNoLltMU6wbyWPoAEns,2719
 aiwaf/storage.py,sha256=5ImrZMRn3u7HNsPH0fDjWhDrD2tgG2IHVnOXtLz0fk4,10253
-aiwaf/trainer.py,sha256=E9jNPq1EHJkKpX1loZrUd2BDBAvH79w_Ltbdb1fsc0Q,25259
+aiwaf/trainer.py,sha256=hswkopOnEQHNkSn79AIk-OWw6zatP2EDhsBBEHQeFYw,26410
 aiwaf/utils.py,sha256=BJk5vJCYdGPl_4QQiknjhCbkzv5HZCXgFcBJDMJpHok,3390
 aiwaf/management/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 aiwaf/management/commands/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -29,8 +29,8 @@ aiwaf/management/commands/test_exemption_fix.py,sha256=ngyGaHUCmQQ6y--6j4q1viZJt
 aiwaf/resources/model.pkl,sha256=5t6h9BX8yoh2xct85MXOO60jdlWyg1APskUOW0jZE1Y,1288265
 aiwaf/templatetags/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 aiwaf/templatetags/aiwaf_tags.py,sha256=XXfb7Tl4DjU3Sc40GbqdaqOEtKTUKELBEk58u83wBNw,357
-aiwaf-0.1.9.2.3.dist-info/licenses/LICENSE,sha256=Ir8PX4dxgAcdB0wqNPIkw84fzIIRKE75NoUil9RX0QU,1069
-aiwaf-0.1.9.2.3.dist-info/METADATA,sha256=nLqJ4rOXO6IFxBr_0EBdnlYRk824Uii9KYLnsObfJx0,26824
-aiwaf-0.1.9.2.3.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-aiwaf-0.1.9.2.3.dist-info/top_level.txt,sha256=kU6EyjobT6UPCxuWpI_BvcHDG0I2tMgKaPlWzVxe2xI,6
-aiwaf-0.1.9.2.3.dist-info/RECORD,,
+aiwaf-0.1.9.2.5.dist-info/licenses/LICENSE,sha256=Ir8PX4dxgAcdB0wqNPIkw84fzIIRKE75NoUil9RX0QU,1069
+aiwaf-0.1.9.2.5.dist-info/METADATA,sha256=YCEXlU9C4qclQ4VB_Tz5Wbn1eGk3DzREmyl83JaZuik,26824
+aiwaf-0.1.9.2.5.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+aiwaf-0.1.9.2.5.dist-info/top_level.txt,sha256=kU6EyjobT6UPCxuWpI_BvcHDG0I2tMgKaPlWzVxe2xI,6
+aiwaf-0.1.9.2.5.dist-info/RECORD,,