analytics-platform 0.2.1__py3-none-any.whl

analytics_platform/posture.py

@@ -0,0 +1,264 @@
+"""How the server is set up (protocol in sdk/protocols/posture.md): the
+settings that leave the app open (Django's, when it's a Django site), whether
+it runs as root, code anyone on the machine can write, and files in the
+folders it serves to the web that should never be public. Sent to
+POST /events/posture a few minutes after start and then once a day (the
+collector's `every`), so Security -> Security check can say what to change.
+
+It only reads: nothing here changes a setting, a permission or a file, and no
+file's contents are sent -- paths, sizes, times and short values only. The
+walk is bounded and runs in a background thread, never in a request; with no
+folder served to the web there is nothing to walk and only the settings are
+reported.
+"""
+import os
+import re
+import socket
+import stat
+from datetime import datetime, timezone
+
+from .core import Periodic
+
+FIRST = 180
+RETRY_EVERY = 60 * 60
+EVERY = 24 * 60 * 60
+MAX_CHECKS = 200
+MAX_EXPOSURE = 50
+MAX_ENTRIES = 20000
+MAX_DEPTH = 6
+MAX_PERM_CHECKS = 3000
+SKIP_DIRS = {".git", ".svn", ".hg", "node_modules", "vendor", "cache", ".cache", ".history", "__pycache__"}
+CODE_FILE = re.compile(r"\.(py|pyw|js|cjs|mjs|php[0-9]?|phtml|rb|pl|sh)$", re.I)
+# Files that shouldn't be downloadable, by name; first match wins.
+EXPOSURE = [
+    ("database_dump", re.compile(r"\.sql(\.(gz|bz2|xz|zip))?$", re.I)),
+    ("private_key", re.compile(r"^(id_rsa|id_dsa|id_ecdsa|id_ed25519)$|\.(pem|key|p12|pfx|jks)$", re.I)),
+    ("env", re.compile(r"^\.env($|\.)|^env\.(ini|txt)$", re.I)),
+    ("archive", re.compile(r"\.(zip|tar|tgz|tar\.gz|tar\.bz2|rar|7z)$", re.I)),
+    ("backup", re.compile(r"\.(bak|old|orig|save|swp|copy|backup)$|~$|\.(py|json|conf|config|ini|ya?ml)\.(bak|old|orig|save|txt)$", re.I)),
+    ("info", re.compile(r"^(phpinfo|info|adminer)\.php$", re.I)),
+    ("log", re.compile(r"^(debug|error|access)[-_.]?log$|\.log$", re.I)),
+]
+# Django's own placeholders, and what a key looks like when nobody set one.
+INSECURE_KEYS = ("django-insecure-", "changeme", "secret", "your-secret-key", "put-your-secret-key-here")
+
+
+def kind_of(name):
+    for kind, pattern in EXPOSURE:
+        if pattern.search(name):
+            return kind
+    return None
+
+
+def without_nested(roots):
+    """A folder inside another folder on the list is already covered: without
+    this, every file under it would be reported twice."""
+    unique = {}
+    for root in roots:
+        unique.setdefault(root["dir"], root)
+    return [root for root in unique.values()
+            if not any(other != root["dir"] and (root["dir"] + "/").startswith(other + "/") for other in unique)]
+
+
+def roots_of(given):
+    """[{"dir", "prefix"}]: `prefix` is where the web serves the folder, so the
+    path we report is the one the dashboard can ask the site for. Not told:
+    Django's STATIC_ROOT and MEDIA_ROOT, when they're set and there."""
+    roots = []
+    for entry in given or []:
+        folder = entry.get("dir") if isinstance(entry, dict) else entry
+        if not folder:
+            continue
+        prefix = str(entry.get("prefix") or "").strip("/") if isinstance(entry, dict) else ""
+        roots.append({"dir": os.path.abspath(str(folder)), "prefix": prefix})
+    if roots:
+        return without_nested(roots)
+    for folder, url in django_static_dirs():
+        if folder and os.path.isdir(folder):
+            roots.append({"dir": os.path.abspath(folder), "prefix": str(url or "").strip("/")})
+    return without_nested(roots)
+
+
+def django_settings():
+    """Django's settings, or None when this isn't a configured Django site."""
+    try:
+        from django.conf import settings
+        if not settings.configured:
+            return None
+        settings.DEBUG  # raises when there are no settings to read
+        return settings
+    except Exception:
+        return None
+
+
+def django_static_dirs():
+    settings = django_settings()
+    if settings is None:
+        return []
+    out = []
+    for folder, url in ((getattr(settings, "STATIC_ROOT", None), getattr(settings, "STATIC_URL", "")),
+                        (getattr(settings, "MEDIA_ROOT", None), getattr(settings, "MEDIA_URL", ""))):
+        if folder:
+            out.append((str(folder), str(url or "")))
+    return out
+
+
+def django_checks():
+    """The Django settings that decide how much a hole in the site is worth."""
+    settings = django_settings()
+    if settings is None:
+        return []
+    checks = []
+
+    def add(check_id, failed, value=""):
+        row = {"id": check_id, "state": "unknown" if failed is None else ("fail" if failed else "pass")}
+        if value:
+            row["value"] = value
+        checks.append(row)
+
+    add("app.django_debug", bool(getattr(settings, "DEBUG", False)))
+    key = str(getattr(settings, "SECRET_KEY", "") or "")
+    add("app.secret_key", not key or len(key) < 32 or any(mark in key.lower() for mark in INSECURE_KEYS))
+    hosts = list(getattr(settings, "ALLOWED_HOSTS", []) or [])
+    add("app.allowed_hosts", "*" in hosts, ", ".join(str(h) for h in hosts[:10]))
+    # Cookie flags only matter once the site is on HTTPS, which these say it is.
+    https = bool(getattr(settings, "SECURE_SSL_REDIRECT", False)) or bool(getattr(settings, "SESSION_COOKIE_SECURE", False)) \
+        or bool(getattr(settings, "CSRF_COOKIE_SECURE", False)) or bool(getattr(settings, "SECURE_HSTS_SECONDS", 0))
+    add("app.session_cookie_httponly", not getattr(settings, "SESSION_COOKIE_HTTPONLY", True))
+    if https:
+        add("app.session_cookie_secure", not getattr(settings, "SESSION_COOKIE_SECURE", False))
+        add("app.csrf_cookie_secure", not getattr(settings, "CSRF_COOKIE_SECURE", False))
+        add("app.https_redirect", not getattr(settings, "SECURE_SSL_REDIRECT", False))
+    return checks
+
+
+def app_checks():
+    checks = []
+    for check in django_checks():
+        checks.append(check)
+    if hasattr(os, "getuid"):
+        # Running the web app as root turns any hole in it into the whole machine.
+        checks.append({"id": "server.runs_as_root", "state": "fail" if os.getuid() == 0 else "pass"})
+    return checks
+
+
+def walk(roots):
+    """One bounded walk per root: (exposure, writable or None, examples, truncated)."""
+    exposure, examples = [], []
+    writable = checked = entries = 0
+    for root in roots:
+        queue = [(root["dir"], 0)]
+        while queue:
+            folder, depth = queue.pop(0)
+            try:
+                names = os.listdir(folder)
+            except OSError:
+                continue
+            for name in names:
+                entries += 1
+                if entries > MAX_ENTRIES:
+                    return exposure, (writable if checked else None), examples, True
+                path = os.path.join(folder, name)
+                if os.path.islink(path):
+                    continue
+                relative = "/".join(p for p in (root["prefix"], os.path.relpath(path, root["dir"]).replace(os.sep, "/")) if p)
+                if os.path.isdir(path):
+                    if name in (".git", ".svn", ".hg", ".bzr"):
+                        if len(exposure) < MAX_EXPOSURE:
+                            exposure.append({"path": relative + "/config", "kind": "vcs"})
+                        continue
+                    if depth + 1 <= MAX_DEPTH and name not in SKIP_DIRS:
+                        queue.append((path, depth + 1))
+                    continue
+                if not os.path.isfile(path):
+                    continue
+                kind = kind_of(name)
+                if kind and len(exposure) < MAX_EXPOSURE:
+                    row = {"path": relative, "kind": kind}
+                    try:
+                        info = os.stat(path)
+                        row["size"] = info.st_size
+                        row["mtime"] = datetime.fromtimestamp(info.st_mtime, timezone.utc).isoformat().replace("+00:00", "Z")
+                    except OSError:
+                        pass
+                    exposure.append(row)
+                if checked < MAX_PERM_CHECKS and CODE_FILE.search(name):
+                    checked += 1
+                    try:
+                        if os.stat(path).st_mode & stat.S_IWOTH:
+                            writable += 1
+                            if len(examples) < 3:
+                                examples.append(relative)
+                    except OSError:
+                        pass
+    return exposure, (writable if checked else None), examples, False
+
+
+class Posture:
+    """Options: roots (the folders the web serves, as "public" or
+    {"dir": ..., "prefix": "static"}; default: Django's STATIC_ROOT and
+    MEDIA_ROOT), host (the server's name), checks (a callable returning more
+    checks of your own)."""
+
+    def __init__(self, core, roots=None, host=None, checks=None, **_):
+        self.core = core
+        self.roots = roots_of(roots)
+        self.extra = checks
+        self.host = re.sub(r"[^A-Za-z0-9._-]", "-", str(host if host is not None else socket.gethostname()))[:100] or "server"
+        self.job = Periodic(self._report, FIRST) if core.valid else None
+
+    def report(self):
+        """What would be reported now (also used by the job and by tests)."""
+        exposure, writable, examples, truncated = walk(self.roots)
+        checks = app_checks()
+        if writable is not None:
+            row = {"id": "server.code_writable", "state": "fail" if writable else "pass"}
+            if writable:
+                row["value"] = "%d files, e.g. %s" % (writable, ", ".join(examples))
+            checks.append(row)
+        try:
+            for check in (self.extra() if callable(self.extra) else []) or []:
+                if isinstance(check, dict) and check.get("id") and check.get("state") in ("pass", "fail", "unknown"):
+                    row = {"id": str(check["id"]).lower()[:60], "state": check["state"]}
+                    if check.get("value"):
+                        row["value"] = str(check["value"])[:200]
+                    checks.append(row)
+        except Exception:
+            pass
+        import platform as _platform
+        body = {
+            "site_id": self.core.site_id,
+            "host": self.host,
+            "at": datetime.now(timezone.utc).isoformat().replace("+00:00", "Z"),
+            "checks": checks[:MAX_CHECKS],
+            "facts": {"agent": "python/%s" % _platform.python_version()},
+        }
+        if self.roots:
+            # Left out when there's no folder to walk: the dashboard then says
+            # this wasn't checked, instead of taking an empty walk for a clean one.
+            body["exposure"] = exposure[:MAX_EXPOSURE]
+            body["facts"]["webroot"] = self.roots[0]["dir"]
+        if truncated:
+            body["truncated"] = True
+        return body
+
+    def _report(self):
+        # The set-up checks ride the software inventory switch.
+        if not self.core.is_on("inventory"):
+            return RETRY_EVERY
+        res = self.core.send("posture", "/events/posture", auth="bearer", body=self.report())
+        if res is None or not getattr(res, "ok", False):
+            return RETRY_EVERY
+        try:
+            answer = res.json()
+        except Exception:
+            answer = {}
+        every = int(answer.get("every") or EVERY) if isinstance(answer, dict) else EVERY
+        return max(RETRY_EVERY, every)
+
+    def flush(self):
+        pass
+
+    def close(self):
+        if self.job:
+            self.job.stop()

analytics_platform/proxy.py

@@ -0,0 +1,170 @@
+"""First-party proxy: serving the tracker from the site's own domain, so ad
+blockers don't hide visitors.
+
+Blockers stop analytics by recognising the address a script comes from and
+what it is called ("track.js", "collect"). The answer is to serve both from
+the site's own domain, which until now meant writing Nginx, Cloudflare or
+Vercel rules by hand. This app is already a server on that domain, so the
+package does it itself:
+
+    <prefix>/js/<rest>   ->  <endpoint>/<rest>                  (tracker files)
+    <prefix>/api/<rest>  ->  <endpoint>/collectanalytics/<rest> (the collector)
+
+The same two rules as the hand-written ones, so one install check covers both.
+The prefix comes from the site secret: not guessable from the page, and the
+same every time, so a browser's cache and a CDN in front stay valid.
+
+It answers before every other module: a visitor's beacon is our own traffic,
+not a page of the site, so it shouldn't be counted, timed or rate-limited.
+"""
+import hashlib
+import re
+import time
+import urllib.error
+import urllib.request
+
+# The tracker files, by name: anything else is refused rather than forwarded.
+FILES = frozenset((
+    "track.js", "s.js", "snapshot.js", "replay.js", "survey.js", "banner.js",
+    "leadform.js", "notice.js", "editor.js", "picker.js", "feedback.js", "shield.js",
+))
+# A pinned version never changes; /v<major>/ follows new releases, so it is
+# held for an hour, the same as the collector serves it with.
+TTL_PINNED_S = 7 * 24 * 60 * 60
+TTL_MAJOR_S = 60 * 60
+TIMEOUT = 5
+MAX_BODY = 6 * 1024 * 1024
+# The collector reads these; everything else, cookies above all, stays here.
+PASS_HEADERS = ("content-type", "user-agent", "accept-language", "referer", "origin",
+                "sec-fetch-site", "sec-ch-ua", "sec-ch-ua-mobile", "sec-ch-ua-platform")
+SAFE_PATH = re.compile(r"^[A-Za-z0-9/_.-]{1,120}$")
+FILE_PATH = re.compile(r"^v(\d+(?:\.\d+\.\d+)?)/([a-z]+\.js)$")
+NOT_FOUND = (404, [("Content-Type", "text/plain; charset=utf-8")], b"Not found")
+
+
+def prefix_for(secret):
+    return hashlib.sha256(("proxy|" + str(secret)).encode("utf-8")).hexdigest()[:8]
+
+
+class Proxy:
+    """prefix: the path it answers on (default: from the secret)."""
+
+    def __init__(self, core, prefix=None, enabled=True):
+        self.core = core
+        self.enabled = enabled
+        self.prefix = re.sub(r"[^A-Za-z0-9_-]", "", str(prefix or prefix_for(core.secret)))
+        # One copy of each tracker file, so a repeat visitor costs no upstream
+        # request. A handful of small files: it never grows.
+        self._files = {}
+
+    def on(self):
+        return bool(self.enabled and self.core.valid and self.prefix and self.core.is_on("proxy"))
+
+    def script_url(self, version="1"):
+        """The tracker's address on this site, for the page's script tag."""
+        return "/%s/js/v%s/s.js" % (self.prefix, version)
+
+    def collect_url(self):
+        """Where visits are sent, for the tag's data-collect."""
+        return "/%s/api/e" % self.prefix
+
+    def match(self, path):
+        """("js" | "api", the rest) when the address is ours, else None."""
+        if not self.on():
+            return None
+        head = "/%s/" % self.prefix
+        if not path.startswith(head):
+            return None
+        rest = path[len(head):]
+        for kind in ("js", "api"):
+            if rest.startswith(kind + "/"):
+                tail = rest[len(kind) + 1:]
+                if tail and ".." not in tail and SAFE_PATH.match(tail):
+                    return kind, tail
+                break
+        return "bad", ""
+
+    def handle(self, kind, rest, method="GET", query="", headers=None, body=None, client_ip=""):
+        """(status, [(name, value)], body). Blocking: an ASGI caller runs it
+        in a thread so the event loop keeps turning."""
+        if kind == "js":
+            return self._file(rest)
+        if kind != "api":
+            return NOT_FOUND
+        return self._collector(rest, method, query, headers or {}, body, client_ip)
+
+    def _file(self, rest):
+        found = FILE_PATH.match(rest)
+        if not found or found.group(2) not in FILES:
+            return NOT_FOUND
+        pinned = "." in found.group(1)
+        held = self._files.get(rest)
+        body = None
+        if held and held[1] > time.time() - (TTL_PINNED_S if pinned else TTL_MAJOR_S):
+            body = held[0]
+        if body is None:
+            try:
+                request = urllib.request.Request(self.core.endpoint + "/" + rest, method="GET")
+                with urllib.request.urlopen(request, timeout=TIMEOUT) as answer:
+                    fetched = answer.read(MAX_BODY)
+                if len(fetched) > 500:
+                    body = fetched
+                    self._files[rest] = (body, time.time())
+            except Exception as error:
+                self.core.log("proxy", "could not fetch %s: %s" % (rest, error))
+            # Upstream is unreachable: an old copy beats no tracker at all.
+            if body is None and held:
+                body = held[0]
+        if body is None:
+            return 502, [], b""
+        return 200, [
+            ("Content-Type", "application/javascript; charset=utf-8"),
+            ("Cache-Control", "public, max-age=31536000, immutable" if pinned else "public, max-age=3600"),
+            ("X-Content-Type-Options", "nosniff"),
+        ], body
+
+    def _collector(self, rest, method, query, headers, body, client_ip):
+        method = (method or "GET").upper()
+        if method == "OPTIONS":
+            # Same origin as the page, so a preflight shouldn't happen; answer
+            # it cheaply rather than passing it on.
+            return 204, [("Access-Control-Allow-Methods", "GET, POST, OPTIONS"),
+                         ("Access-Control-Allow-Headers", "Content-Type"),
+                         ("Access-Control-Max-Age", "86400")], b""
+        if method not in ("GET", "POST"):
+            return NOT_FOUND
+        if body is not None and len(body) > MAX_BODY:
+            return 413, [], b""
+        # The visitor's address: the collector needs it for the country, the
+        # daily visitor ID and the per-visitor rate limit.
+        out = {"X-Forwarded-For": client_ip or ""}
+        for name in PASS_HEADERS:
+            value = headers.get(name)
+            if value:
+                out[name.title()] = str(value).replace("\r", "").replace("\n", "")
+        url = self.core.endpoint + "/collectanalytics/" + rest + (("?" + query) if query else "")
+        request = urllib.request.Request(url, data=body if method == "POST" else None, headers=out, method=method)
+        try:
+            with urllib.request.urlopen(request, timeout=TIMEOUT) as answer:
+                return answer.status, self._answer_headers(answer.headers), answer.read(MAX_BODY)
+        except urllib.error.HTTPError as answer:
+            return answer.code, self._answer_headers(answer.headers), answer.read(MAX_BODY)
+        except Exception as error:
+            # The tracker already treats a failed beacon as lost and carries on.
+            self.core.log("proxy", "could not reach the collector: %s" % error)
+            return 502, [], b""
+
+    @staticmethod
+    def _answer_headers(headers):
+        out = []
+        for name in ("Content-Type", "Cache-Control", "Retry-After"):
+            value = headers.get(name)
+            if value:
+                out.append((name, value))
+        return out
+
+    def flush(self):
+        pass
+
+    def close(self):
+        pass

analytics_platform/request_rules.py

@@ -0,0 +1,175 @@
+"""Request rules (virtual patching; protocol in sdk/protocols/firewall.md):
+the firewall has always matched addresses, these match the request -- its
+method, path, query string and user agent -- so an attack is turned away
+before the vulnerable code runs. They arrive with the other rules and are
+compiled once per fetch; matching is plain string work on text we already
+have, so it costs nothing per request.
+
+The matching is the same in every package: the shared cases are in
+sdk/protocols/request-rules-cases.json, and this module is run against them by
+tests/test_request_rules.py.
+"""
+import re
+from urllib.parse import unquote_plus
+
+MAX_RULES = 200
+# How much of each part a rule may look at. Patterns come from our rules, but
+# the text comes from whoever is asking, and `re` can't be timed out: a bounded
+# slice keeps a bad pattern from being a hung request.
+MAX_TEXT = 2000
+MAX_REGEX = 200
+SECTIONS = ("path", "query", "ua")
+
+
+def _lower_list(entries, allow_empty=False):
+    return [e.lower() for e in entries if isinstance(e, str) and (allow_empty or e != "")]
+
+
+def safe_pattern(pattern):
+    """A pattern can only come from us, but a careless one would be matched
+    against text an attacker chooses, in this very request, and `re` can't be
+    timed out. So the client checks the shape itself instead of trusting what it
+    was handed: a quantifier on a group that itself repeats ("(a+)+") takes
+    exponential time on input that nearly matches. Backreferences and lookbehind
+    are refused for the same reason."""
+    if not isinstance(pattern, str) or not pattern or len(pattern) > MAX_REGEX:
+        return False
+    if re.search(r"\\[1-9]", pattern) or "(?<" in pattern:
+        return False
+    open_at = []
+    i = 0
+    while i < len(pattern):
+        char = pattern[i]
+        if char == "\\":
+            i += 2
+            continue
+        if char == "[":
+            # A character class: quantifiers inside it are literals.
+            i += 1
+            while i < len(pattern) and pattern[i] != "]":
+                i += 2 if pattern[i] == "\\" else 1
+            i += 1
+            continue
+        if char == "(":
+            open_at.append(i)
+        elif char == ")":
+            if not open_at:
+                return False
+            start = open_at.pop()
+            nxt = pattern[i + 1] if i + 1 < len(pattern) else ""
+            if nxt in ("*", "+", "{"):
+                inside = pattern[start + 1:i]
+                if re.search(r"(^|[^\\])[*+]", inside) or re.search(r"(^|[^\\])\{[0-9]", inside):
+                    return False
+        i += 1
+    return not open_at
+
+
+def _section(section):
+    if not isinstance(section, dict):
+        return None
+    out = {}
+    for matcher in ("exact", "prefix", "suffix", "contains"):
+        entries = section.get(matcher)
+        if not isinstance(entries, list):
+            continue
+        values = _lower_list(entries, allow_empty=matcher == "exact")
+        if values:
+            out[matcher] = values
+    pattern = section.get("regex")
+    if safe_pattern(pattern):
+        try:
+            out["regex"] = re.compile(pattern, re.IGNORECASE)
+        except re.error:
+            # A pattern we can't compile is dropped; the rule's other parts stay.
+            pass
+    return out or None
+
+
+def compile_rules(data):
+    """The rules as they will be matched; [] when there are none."""
+    given = data.get("rules") if isinstance(data, dict) else None
+    rules = []
+    for rule in (given if isinstance(given, list) else [])[:MAX_RULES]:
+        if not isinstance(rule, dict) or not isinstance(rule.get("id"), str) or not rule["id"]:
+            continue
+        # We are called before the body is read, so a rule that needs the body
+        # is skipped whole rather than matched on the rest of it.
+        if "body" in rule:
+            continue
+        methods = rule.get("methods")
+        compiled = {
+            "id": rule["id"],
+            "action": "block" if rule.get("action") == "block" else "monitor",
+            "ban": int(rule["ban"]) if isinstance(rule.get("ban"), (int, float)) and int(rule["ban"]) > 0 else 0,
+            "methods": [m.upper() for m in methods if isinstance(m, str)] if isinstance(methods, list) else [],
+        }
+        sections = 0
+        for name in SECTIONS:
+            section = _section(rule.get(name))
+            if section is not None:
+                compiled[name] = section
+                sections += 1
+        # A rule with nothing to match would match everything.
+        if not sections:
+            continue
+        rules.append(compiled)
+    return rules
+
+
+def _decode_once(text):
+    """One pass only, as the protocol says: enough for %2e%2e, and no risk of
+    decoding a visitor's own text into something that looks like an attack."""
+    if "%" not in text and "+" not in text:
+        return text
+    try:
+        return unquote_plus(text)
+    except Exception:
+        return text
+
+
+def _normalize_path(path):
+    return re.sub(r"/{2,}", "/", path.lower().replace("\\", "/"))
+
+
+def _hits(section, raw, decoded):
+    texts = (raw,) if decoded == raw else (raw, decoded)
+    for text in texts:
+        if text in section.get("exact", ()):
+            return True
+        if any(text.startswith(entry) for entry in section.get("prefix", ())):
+            return True
+        if any(entry and text.endswith(entry) for entry in section.get("suffix", ())):
+            return True
+        if any(entry and entry in text for entry in section.get("contains", ())):
+            return True
+        regex = section.get("regex")
+        if regex is not None and regex.search(text):
+            return True
+    return False
+
+
+def match_request(rules, method="", path="", user_agent=""):
+    """The first rule that matches, or None. `path` is the request target as
+    the server received it, query string and all."""
+    if not rules:
+        return None
+    target = str(path or "")
+    mark = target.find("?")
+    raw_path = _normalize_path((target if mark == -1 else target[:mark])[:MAX_TEXT])
+    raw_query = ("" if mark == -1 else target[mark + 1:])[:MAX_TEXT].lower()
+    ua = str(user_agent or "")[:MAX_TEXT].lower()
+    decoded_path = _normalize_path(_decode_once((target if mark == -1 else target[:mark])[:MAX_TEXT])[:MAX_TEXT])
+    decoded_query = _decode_once(raw_query)[:MAX_TEXT]
+    upper = str(method or "").upper()
+    for rule in rules:
+        if rule["methods"] and upper not in rule["methods"]:
+            continue
+        if "path" in rule and not _hits(rule["path"], raw_path, decoded_path):
+            continue
+        if "query" in rule and not _hits(rule["query"], raw_query, decoded_query):
+            continue
+        if "ua" in rule and not _hits(rule["ua"], ua, ua):
+            continue
+        return rule
+    return None