aiwaf 0.1.9.3.3__py3-none-any.whl → 0.1.9.3.4__py3-none-any.whl

aiwaf/middleware.py

@@ -504,6 +504,51 @@ class AIAnomalyMiddleware(MiddlewareMixin):
         
         return any(malicious_indicators)
 
+    def _is_scanning_path(self, path):
+        """
+        Determine if a 404 path looks like automated scanning vs legitimate browsing.
+        Focus on common scanner patterns that indicate malicious intent.
+        """
+        path_lower = path.lower()
+        
+        # Common scanning patterns that are clear indicators of malicious activity
+        scanning_patterns = [
+            # WordPress scanning
+            'wp-admin', 'wp-content', 'wp-includes', 'wp-config', 'xmlrpc.php',
+            
+            # Admin/config scanning  
+            'admin', 'phpmyadmin', 'adminer', 'config', 'configuration',
+            'settings', 'setup', 'install', 'installer',
+            
+            # Database/backup scanning
+            'backup', 'database', 'db', 'mysql', 'sql', 'dump',
+            
+            # System files scanning
+            '.env', '.git', '.htaccess', '.htpasswd', 'passwd', 'shadow',
+            'robots.txt', 'sitemap.xml',
+            
+            # Common vulnerabilities
+            'cgi-bin', 'scripts', 'shell', 'cmd', 'exec',
+            
+            # File extensions that shouldn't exist on most sites
+            '.php', '.asp', '.aspx', '.jsp', '.cgi', '.pl'
+        ]
+        
+        # Check for scanning patterns
+        for pattern in scanning_patterns:
+            if pattern in path_lower:
+                return True
+                
+        # Check for directory traversal attempts
+        if '../' in path or '..' in path:
+            return True
+            
+        # Check for encoded attack patterns  
+        if any(encoded in path for encoded in ['%2e%2e', '%252e', '%c0%ae']):
+            return True
+            
+        return False
+
     def process_request(self, request):
         # First exemption check - early exit for exempt requests
         if is_exempt(request):
@@ -564,27 +609,27 @@ class AIAnomalyMiddleware(MiddlewareMixin):
                 # Get recent behavior data for this IP to make intelligent blocking decision
                 recent_data = [d for d in data if now - d[0] <= 300]  # Last 5 minutes
                 
-                if recent_data:
-                    # Calculate behavior metrics similar to trainer.py
-                    recent_kw_hits = []
-                    recent_404s = 0
-                    recent_burst_counts = []
+                # Always initialize variables before use
+                recent_kw_hits = []
+                recent_404s = 0
+                recent_burst_counts = []
                 
-                for entry_time, entry_path, entry_status, entry_resp_time in recent_data:
-                    # Calculate keyword hits for this entry
-                    entry_known_path = path_exists_in_django(entry_path)
-                    entry_kw_hits = 0
-                    if not entry_known_path and not is_exempt_path(entry_path):
-                        entry_kw_hits = sum(1 for kw in STATIC_KW if kw in entry_path.lower())
-                    recent_kw_hits.append(entry_kw_hits)
-                    
-                    # Count 404s
-                    if entry_status == 404:
-                        recent_404s += 1
-                    
-                    # Calculate burst for this entry (requests within 10 seconds)
-                    entry_burst = sum(1 for (t, _, _, _) in recent_data if abs(entry_time - t) <= 10)
-                    recent_burst_counts.append(entry_burst)
+                if recent_data:
+                    for entry_time, entry_path, entry_status, entry_resp_time in recent_data:
+                        # Calculate keyword hits for this entry
+                        entry_known_path = path_exists_in_django(entry_path)
+                        entry_kw_hits = 0
+                        if not entry_known_path and not is_exempt_path(entry_path):
+                            entry_kw_hits = sum(1 for kw in STATIC_KW if kw in entry_path.lower())
+                        recent_kw_hits.append(entry_kw_hits)
+                        
+                        # Count 404s
+                        if entry_status == 404:
+                            recent_404s += 1
+                        
+                        # Calculate burst for this entry (requests within 10 seconds)
+                        entry_burst = sum(1 for (t, _, _, _) in recent_data if abs(entry_time - t) <= 10)
+                        recent_burst_counts.append(entry_burst)
                 
                 # Calculate averages and maximums
                 avg_kw_hits = sum(recent_kw_hits) / len(recent_kw_hits) if recent_kw_hits else 0
@@ -592,28 +637,37 @@ class AIAnomalyMiddleware(MiddlewareMixin):
                 avg_burst = sum(recent_burst_counts) / len(recent_burst_counts) if recent_burst_counts else 0
                 total_requests = len(recent_data)
                 
-                # Don't block if it looks like legitimate behavior (same thresholds as trainer.py):
+                # Enhanced 404 analysis - focus on scanning patterns
+                scanning_404s = sum(1 for (_, path, status, _) in recent_data 
+                                  if status == 404 and self._is_scanning_path(path))
+                legitimate_404s = max_404s - scanning_404s
+                
+                # Don't block if it looks like legitimate behavior:
                 if (
-                    avg_kw_hits < 2 and           # Not hitting many malicious keywords
-                    max_404s < 10 and            # Not excessive 404s
-                    avg_burst < 15 and           # Not excessive burst activity
-                    total_requests < 100         # Not excessive total requests
+                    avg_kw_hits < 3 and           # Allow some keyword hits (increased from 2)
+                    scanning_404s < 5 and        # Focus on scanning 404s, not all 404s  
+                    legitimate_404s < 20 and     # Allow more legitimate 404s (typos, old links)
+                    avg_burst < 25 and           # Allow higher burst (increased from 15)
+                    total_requests < 150         # Allow more total requests (increased from 100)
                 ):
                     # Anomalous but looks legitimate - don't block
                     pass
                 else:
                     # Double-check exemption before blocking
                     if not exemption_store.is_exempted(ip):
-                        BlacklistManager.block(ip, f"AI anomaly + suspicious patterns (kw:{avg_kw_hits:.1f}, 404s:{max_404s}, burst:{avg_burst:.1f})")
+                        BlacklistManager.block(ip, f"AI anomaly + scanning 404s (total:{max_404s}, scanning:{scanning_404s}, kw:{avg_kw_hits:.1f}, burst:{avg_burst:.1f})")
                         # Check if actually blocked (exempted IPs won't be blocked)
                         if BlacklistManager.is_blocked(ip):
                             return JsonResponse({"error": "blocked"}, status=403)
             else:
-                # No recent data to analyze - be more conservative, only block on very suspicious current request
-                if kw_hits >= 2 or status_idx == STATUS_IDX.index("404"):
+                # No recent data to analyze - be more conservative
+                # Only block on multiple suspicious indicators, not single 404
+                current_scanning = self._is_scanning_path(request.path)
+                
+                if kw_hits >= 3 and current_scanning:  # Require both high keywords AND scanning pattern
                     # Double-check exemption before blocking
                     if not exemption_store.is_exempted(ip):
-                        BlacklistManager.block(ip, "AI anomaly + immediate suspicious behavior")
+                        BlacklistManager.block(ip, f"AI anomaly + scanning behavior (kw:{kw_hits}, scanning_path:{request.path})")
                         if BlacklistManager.is_blocked(ip):
                             return JsonResponse({"error": "blocked"}, status=403)
 
@@ -644,10 +698,13 @@ class HoneypotTimingMiddleware(MiddlewareMixin):
     MAX_PAGE_TIME = getattr(settings, "AIWAF_MAX_PAGE_TIME", 240)  # 4 minutes default
     
     def _view_accepts_method(self, request, method):
-        """Check if the current view/URL pattern accepts the specified HTTP method"""
+        """
+        Check if the current view accepts the specified HTTP method.
+        Be very conservative - only block when we're absolutely certain.
+        Handle decorator issues by being permissive when detection fails.
+        """
         try:
             from django.urls import resolve
-            from django.urls.resolvers import URLResolver, URLPattern
             
             # Resolve the current URL to get the view
             resolved = resolve(request.path)
@@ -657,12 +714,12 @@ class HoneypotTimingMiddleware(MiddlewareMixin):
             if hasattr(view_func, 'cls'):
                 view_class = view_func.cls
                 
-                # Check http_method_names attribute (most reliable)
+                # Check http_method_names attribute (most reliable for CBVs)
                 if hasattr(view_class, 'http_method_names'):
                     allowed_methods = [m.upper() for m in view_class.http_method_names]
                     return method.upper() in allowed_methods
                 
-                # Check for method-handling methods
+                # For CBVs without http_method_names, check for method handlers
                 method_handlers = {
                     'GET': ['get'],
                     'POST': ['post', 'form_valid', 'form_invalid'],
@@ -674,76 +731,30 @@ class HoneypotTimingMiddleware(MiddlewareMixin):
                 if method.upper() in method_handlers:
                     handlers = method_handlers[method.upper()]
                     has_handler = any(hasattr(view_class, handler) for handler in handlers)
-                    if has_handler:
-                        return True
-                    
-                    # If no handler found, check if it's a common method that should be rejected
-                    if method.upper() in ['GET', 'POST', 'PUT', 'DELETE', 'PATCH']:
-                        return False
+                    return has_handler
                 
-                # Default: assume method is allowed for class-based views
+                # Default for CBVs: be permissive
                 return True
             
-            # Handle function-based views
+            # Handle function-based views (including decorated ones)
             else:
-                # Check if view has explicit allowed methods
-                if hasattr(view_func, 'http_method_names'):
-                    allowed_methods = [m.upper() for m in view_func.http_method_names]
-                    return method.upper() in allowed_methods
+                # Try to unwrap decorators to get the actual view function
+                actual_func = view_func
+                while hasattr(actual_func, '__wrapped__'):
+                    actual_func = actual_func.__wrapped__
                 
-                # For function-based views, inspect the source code
-                import inspect
-                try:
-                    source = inspect.getsource(view_func)
-                    method_upper = method.upper()
-                    
-                    # Look for method handling in the source
-                    if f'request.method' in source and method_upper in source:
-                        return True
-                    
-                    # Look for method-specific patterns
-                    method_patterns = {
-                        'GET': ['request.GET', 'GET'],
-                        'POST': ['request.POST', 'POST', 'form.is_valid()'],
-                        'PUT': ['PUT', 'request.PUT'],
-                        'DELETE': ['DELETE', 'request.DELETE']
-                    }
-                    
-                    if method.upper() in method_patterns:
-                        patterns = method_patterns[method.upper()]
-                        if any(pattern in source for pattern in patterns):
-                            return True
-                            
-                except (OSError, TypeError):
-                    # Can't get source, make educated guess
-                    pass
-                
-                # Check URL pattern name for method-specific endpoints
-                if resolved.url_name:
-                    url_name_lower = resolved.url_name.lower()
-                    
-                    # POST-only patterns
-                    post_only_patterns = ['create', 'submit', 'upload', 'process']
-                    # GET-only patterns  
-                    get_only_patterns = ['list', 'detail', 'view', 'display']
-                    
-                    if method.upper() == 'POST':
-                        if any(pattern in url_name_lower for pattern in post_only_patterns):
-                            return True
-                        if any(pattern in url_name_lower for pattern in get_only_patterns):
-                            return False
-                    elif method.upper() == 'GET':
-                        if any(pattern in url_name_lower for pattern in get_only_patterns):
-                            return True
-                        if any(pattern in url_name_lower for pattern in post_only_patterns):
-                            return False
+                # Check if the actual function has explicit allowed methods
+                if hasattr(actual_func, 'http_method_names'):
+                    allowed_methods = [m.upper() for m in actual_func.http_method_names]
+                    return method.upper() in allowed_methods
                 
-                # Default: assume function-based views accept common methods
-                return method.upper() in ['GET', 'POST', 'HEAD', 'OPTIONS']
+                # For function-based views, be very conservative
+                # Most Django views accept both GET and POST, so default to allowing
+                return True
                 
         except Exception as e:
-            # If we can't determine, err on the side of caution and allow
-            print(f"AIWAF: Could not determine {method} capability for {request.path}: {e}")
+            # If anything fails (decorators, imports, etc.), be permissive
+            # Better to allow a legitimate request than block it
             return True
     
     def process_request(self, request):
@@ -759,16 +770,25 @@ class HoneypotTimingMiddleware(MiddlewareMixin):
             return None
             
         if request.method == "GET":
-            # ENHANCEMENT: Check if this view accepts GET requests
+            # CONSERVATIVE: Only block GET if we're absolutely certain it's POST-only
+            # Most Django views accept both GET and POST (forms show on GET, process on POST)
             if not self._view_accepts_method(request, 'GET'):
-                # This view is POST-only, but received a GET - likely scanning/probing
-                if not exemption_store.is_exempted(ip):
-                    BlacklistManager.block(ip, f"GET to POST-only view: {request.path}")
-                    if BlacklistManager.is_blocked(ip):
-                        return JsonResponse({
-                            "error": "blocked", 
-                            "message": f"GET not allowed for {request.path}"
-                        }, status=405)  # Method Not Allowed
+                # EXTRA CHECK: Only block if path looks like obvious POST-only API endpoint
+                path_lower = request.path.lower()
+                obvious_post_only = any(path_lower.endswith(pattern) for pattern in [
+                    '/create/', '/submit/', '/upload/', '/delete/', '/process/'
+                ])
+                
+                if obvious_post_only:
+                    # This is very likely a POST-only endpoint getting a GET
+                    if not exemption_store.is_exempted(ip):
+                        BlacklistManager.block(ip, f"GET to obvious POST-only endpoint: {request.path}")
+                        if BlacklistManager.is_blocked(ip):
+                            return JsonResponse({
+                                "error": "blocked", 
+                                "message": f"GET not allowed for {request.path}"
+                            }, status=405)  # Method Not Allowed
+                # Otherwise, don't block - could be a decorated view or complex form
             
             # Store timestamp for this IP's GET request  
             # Use a general key for the IP, not path-specific

{aiwaf-0.1.9.3.3.dist-info → aiwaf-0.1.9.3.4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aiwaf
-Version: 0.1.9.3.3
+Version: 0.1.9.3.4
 Summary: AI-powered Web Application Firewall
 Home-page: https://github.com/aayushgauba/aiwaf
 Author: Aayush Gauba
@@ -904,7 +904,3 @@ This project is licensed under the **MIT License**. See the [LICENSE](LICENSE) f
 
 ---
 
-## Credits
-
-**AI‑WAF** by [Aayush Gauba](https://github.com/aayushgauba)  
-> "Let your firewall learn and evolve — keep your site a fortress." your Django `INSTALLED_APPS` to avoid setup errors.

{aiwaf-0.1.9.3.3.dist-info → aiwaf-0.1.9.3.4.dist-info}/RECORD

@@ -2,7 +2,7 @@ aiwaf/__init__.py,sha256=Rnla6te9DNqQBP_HMEdhUdQdj9dd4ECcAr6F62Xs4-A,220
 aiwaf/apps.py,sha256=nCez-Ptlv2kaEk5HenA8b1pATz1VfhrHP1344gwcY1A,142
 aiwaf/blacklist_manager.py,sha256=LYCeKFB-7e_C6Bg2WeFJWFIIQlrfRMPuGp30ivrnhQY,1196
 aiwaf/decorators.py,sha256=IUKOdM_gdroffImRZep1g1wT6gNqD10zGwcp28hsJCs,825
-aiwaf/middleware.py,sha256=lRxi8M22Fp1fdhCWQ6XesbxX54aijH3tdSvjLNroQdE,49197
+aiwaf/middleware.py,sha256=_Erl9GGf1nrfywfghX1NU4CTuveugDlyTgP3sxu6h_A,49928
 aiwaf/middleware_logger.py,sha256=LWZVDAnjh6CGESirA8eMbhGgJKB7lVDGRQqVroH95Lo,4742
 aiwaf/models.py,sha256=vQxgY19BDVMjoO903UNrTZC1pNoLltMU6wbyWPoAEns,2719
 aiwaf/storage.py,sha256=pUXE3bm7aRrABh_B6jTOBUQOYK67oQmHaR9EqyOasis,14038
@@ -29,8 +29,8 @@ aiwaf/management/commands/test_exemption_fix.py,sha256=ngyGaHUCmQQ6y--6j4q1viZJt
 aiwaf/resources/model.pkl,sha256=5t6h9BX8yoh2xct85MXOO60jdlWyg1APskUOW0jZE1Y,1288265
 aiwaf/templatetags/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 aiwaf/templatetags/aiwaf_tags.py,sha256=XXfb7Tl4DjU3Sc40GbqdaqOEtKTUKELBEk58u83wBNw,357
-aiwaf-0.1.9.3.3.dist-info/licenses/LICENSE,sha256=Ir8PX4dxgAcdB0wqNPIkw84fzIIRKE75NoUil9RX0QU,1069
-aiwaf-0.1.9.3.3.dist-info/METADATA,sha256=GUXN2Lav1oOSfMnGTEd7ALU6-95yb7LJYbf4iZN-ukM,30989
-aiwaf-0.1.9.3.3.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-aiwaf-0.1.9.3.3.dist-info/top_level.txt,sha256=kU6EyjobT6UPCxuWpI_BvcHDG0I2tMgKaPlWzVxe2xI,6
-aiwaf-0.1.9.3.3.dist-info/RECORD,,
+aiwaf-0.1.9.3.4.dist-info/licenses/LICENSE,sha256=Ir8PX4dxgAcdB0wqNPIkw84fzIIRKE75NoUil9RX0QU,1069
+aiwaf-0.1.9.3.4.dist-info/METADATA,sha256=bgaJr_xz1U7y_wXrB0xkgXn_LPJknN_9FeTN5Bahe3c,30790
+aiwaf-0.1.9.3.4.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+aiwaf-0.1.9.3.4.dist-info/top_level.txt,sha256=kU6EyjobT6UPCxuWpI_BvcHDG0I2tMgKaPlWzVxe2xI,6
+aiwaf-0.1.9.3.4.dist-info/RECORD,,