analytics-platform 0.3.8__tar.gz → 0.3.10__tar.gz

{analytics_platform-0.3.8 → analytics_platform-0.3.10}/PKG-INFO

@@ -1,9 +1,13 @@
 Metadata-Version: 2.4
 Name: analytics-platform
-Version: 0.3.8
+Version: 0.3.10
 Summary: Firewall, error monitoring and server analytics for your Python server, run from your analytics dashboard.
 Author: steviec87
 License-Expression: MIT
+Project-URL: Homepage, https://sitegoose.com
+Project-URL: Source, https://github.com/StevieC87/Sitegoose-Packages/tree/main/platform-python
+Project-URL: Issues, https://github.com/StevieC87/Sitegoose-Packages/issues
+Project-URL: Security, https://sitegoose.com/security
 Keywords: firewall,waf,rate-limit,error-monitoring,analytics,server-monitoring,django,flask,fastapi,celery,rq,dramatiq,wsgi,asgi
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers

{analytics_platform-0.3.8 → analytics_platform-0.3.10}/analytics_platform/core.py

@@ -23,7 +23,7 @@ import urllib.error
 import urllib.parse
 import urllib.request
 
-VERSION = "0.3.8"
+VERSION = "0.3.10"
 TIMEOUT = 5
 MIN_SYNC = 30
 RETRY = 60
@@ -285,19 +285,24 @@ CLIENTS = ("python", "django")
 
 
 
-# A dashboard header is added only when it is well formed: a token name that
-# isn't one of the headers that frame the response (a Content-Length or
-# Transfer-Encoding of ours would desync it, a Set-Cookie or Content-Type
-# would change what it is), and a value of visible ASCII, spaces and tabs,
-# so no line break, control character or byte a server rejects gets through.
-FRAMING = frozenset(("content-length", "transfer-encoding", "connection", "set-cookie", "content-type"))
-_HEADER_NAME = re.compile(r"[A-Za-z][A-Za-z0-9-]{0,63}")
+# A dashboard header is added only when it is one of the nine the dashboard
+# can produce (expresscollect/Analytics/platform.js, headersOf), in any case,
+# with a value of visible ASCII, spaces and tabs, so no line break, control
+# character or byte a server rejects gets through. A list of what's allowed,
+# not of what isn't: whoever got into our servers still couldn't make this
+# app grant another site its users' data (Access-Control-Allow-*), send every
+# page elsewhere (Refresh), log everyone out (Clear-Site-Data) or change what
+# a response is. Shared cases: sdk/protocols/header-cases.json.
+SECURITY_HEADERS = frozenset((
+    "strict-transport-security", "x-content-type-options", "x-frame-options", "referrer-policy",
+    "permissions-policy", "cross-origin-opener-policy", "content-security-policy",
+    "content-security-policy-report-only", "reporting-endpoints"))
 _HEADER_VALUE = re.compile(r"[\x20-\x7e\t]*")
 
 
 def safe_header(pair):
     return (isinstance(pair, (list, tuple)) and len(pair) == 2 and isinstance(pair[0], str)
-            and _HEADER_NAME.fullmatch(pair[0]) is not None and pair[0].lower() not in FRAMING
+            and pair[0].lower() in SECURITY_HEADERS
             and isinstance(pair[1], str) and len(pair[1]) <= 4000 and _HEADER_VALUE.fullmatch(pair[1]) is not None)
 
 class Core:
@@ -442,6 +447,23 @@ def header(headers, name):
 _PATH_SAFE = "/:@!$&'()*+,;=-._~"
 
 
+_ABSOLUTE = re.compile(r"^[a-zA-Z][a-zA-Z0-9+.-]*://[^/?#]*")
+
+
+def origin_form(target):
+    """The request target as the app routes it: an absolute-form one ("GET
+    http://host/admin", sent as if to a proxy) is routed by its path, so it is
+    cut to "/admin"; matched as written it began "http:" and missed every rule
+    on "/admin". "*" and a target already "/..." are kept as they are."""
+    text = str(target or "")
+    if not text or text.startswith("/") or text == "*":
+        return text
+    rest, count = _ABSOLUTE.subn("", text, count=1)
+    if not count:
+        return text
+    return rest if rest.startswith("/") else "/" + rest
+
+
 def request_target(path, query="", raw=None):
     """The request target as the visitor sent it, query string and all, which
     is what the request rules match (sdk/protocols/firewall.md): the Node and

{analytics_platform-0.3.8 → analytics_platform-0.3.10}/analytics_platform/firewall.py

@@ -19,7 +19,7 @@ import time
 from datetime import datetime, timezone
 
 from . import challenge as browser_check
-from .core import Periodic, RETRY, header
+from .core import Periodic, RETRY, header, origin_form
 from .request_rules import MAX_TEXT, _decode_once, compile_limits, compile_rules, match_limits, match_request, normalize_target, prepare
 
 PROTOCOL = 1
@@ -572,6 +572,7 @@ class Firewall:
         request's headers) are for the browser check: rule "challenge",
         status 503, answered with challenge_page()."""
         allow = {"action": "allow", "rule": "", "status": 200}
+        path = origin_form(path)
         rules = self.rules
         if not rules or not rules["enabled"]:
             return allow
@@ -694,6 +695,7 @@ class Firewall:
         beacons are never rate-limited, checked or matched against request
         rules. -> the same shape as check()."""
         allow = {"action": "allow", "rule": "", "status": 200}
+        path = origin_form(path)
         rules = self.rules
         if not rules or not rules["enabled"]:
             return allow

{analytics_platform-0.3.8 → analytics_platform-0.3.10}/analytics_platform/proxy.py

@@ -49,6 +49,21 @@ PASS_HEADERS = ("content-type", "user-agent", "accept-language", "referer", "ori
                 "sec-fetch-site", "sec-ch-ua", "sec-ch-ua-mobile", "sec-ch-ua-platform")
 SAFE_PATH = re.compile(r"[A-Za-z0-9/_.-]{1,120}\Z")
 FILE_PATH = re.compile(r"v(\d+(?:\.\d+\.\d+)?)/([a-z]+\.js)\Z")
+# What a collector answer may be served as from the site's own domain. Its
+# type comes from the collector, so anything but these three becomes plain
+# text, and nosniff stops a browser guessing: a server that is no longer ours
+# still can't answer <prefix>/api/... with a page that runs as the customer's
+# own site. Shared cases: sdk/protocols/proxy-answer-cases.json.
+ANSWER_TYPES = frozenset(("application/json", "text/plain", "image/webp"))
+_VISIBLE = re.compile(r"[\x20-\x7e]*")
+
+
+def answer_type(value):
+    value = value if isinstance(value, str) else ""
+    kind = value.split(";", 1)[0].strip().lower()
+    return value if kind in ANSWER_TYPES and _VISIBLE.fullmatch(value) else "text/plain; charset=utf-8"
+
+
 NOT_FOUND = (404, [("Content-Type", "text/plain; charset=utf-8")], b"Not found")
 
 
@@ -236,8 +251,8 @@ class Proxy:
 
     @staticmethod
     def _answer_headers(headers):
-        out = []
-        for name in ("Content-Type", "Cache-Control", "Retry-After"):
+        out = [("Content-Type", answer_type(headers.get("Content-Type"))), ("X-Content-Type-Options", "nosniff")]
+        for name in ("Cache-Control", "Retry-After"):
             value = headers.get(name)
             if value:
                 out.append((name, value))

{analytics_platform-0.3.8 → analytics_platform-0.3.10}/analytics_platform.egg-info/PKG-INFO

@@ -1,9 +1,13 @@
 Metadata-Version: 2.4
 Name: analytics-platform
-Version: 0.3.8
+Version: 0.3.10
 Summary: Firewall, error monitoring and server analytics for your Python server, run from your analytics dashboard.
 Author: steviec87
 License-Expression: MIT
+Project-URL: Homepage, https://sitegoose.com
+Project-URL: Source, https://github.com/StevieC87/Sitegoose-Packages/tree/main/platform-python
+Project-URL: Issues, https://github.com/StevieC87/Sitegoose-Packages/issues
+Project-URL: Security, https://sitegoose.com/security
 Keywords: firewall,waf,rate-limit,error-monitoring,analytics,server-monitoring,django,flask,fastapi,celery,rq,dramatiq,wsgi,asgi
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers

{analytics_platform-0.3.8 → analytics_platform-0.3.10}/analytics_platform.egg-info/SOURCES.txt

@@ -39,9 +39,11 @@ tests/test_crawlers.py
 tests/test_errors.py
 tests/test_firewall.py
 tests/test_hardening.py
+tests/test_headers.py
 tests/test_limits.py
 tests/test_page_limits.py
 tests/test_proxy.py
+tests/test_proxy_answer.py
 tests/test_queries.py
 tests/test_redis.py
 tests/test_request_rules.py

{analytics_platform-0.3.8 → analytics_platform-0.3.10}/pyproject.toml

@@ -2,9 +2,15 @@
 requires = ["setuptools>=77"]
 build-backend = "setuptools.build_meta"
 
+[project.urls]
+Homepage = "https://sitegoose.com"
+Source = "https://github.com/StevieC87/Sitegoose-Packages/tree/main/platform-python"
+Issues = "https://github.com/StevieC87/Sitegoose-Packages/issues"
+Security = "https://sitegoose.com/security"
+
 [project]
 name = "analytics-platform"
-version = "0.3.8"
+version = "0.3.10"
 description = "Firewall, error monitoring and server analytics for your Python server, run from your analytics dashboard."
 readme = "README.md"
 requires-python = ">=3.8"

analytics_platform-0.3.10/tests/test_headers.py

@@ -0,0 +1,28 @@
+"""The security headers taken from the platform config, against the cases every
+client shares: sdk/protocols/header-cases.json. Only the nine the dashboard can
+produce get through, so all the packages add the same ones."""
+import json
+import os
+import unittest
+
+from analytics_platform.core import safe_header
+
+CASES = os.path.join(os.path.dirname(__file__), "..", "..", "protocols", "header-cases.json")
+
+
+class HeaderCases(unittest.TestCase):
+    def test_shared_cases(self):
+        with open(CASES, encoding="utf-8") as f:
+            cases = json.load(f)["cases"]
+        for case in cases:
+            value = case["value"] * case.get("repeat", 1)
+            with self.subTest(name=case["name"], value=case["value"][:40], repeat=case.get("repeat")):
+                self.assertEqual(safe_header([case["name"], value]), case["ok"])
+
+    def test_only_pairs_of_strings(self):
+        for pair in (None, "X-Frame-Options", ["X-Frame-Options"], ["X-Frame-Options", 1], ["X-Frame-Options", "DENY", "x"]):
+            self.assertFalse(safe_header(pair))
+
+
+if __name__ == "__main__":
+    unittest.main()

analytics_platform-0.3.10/tests/test_proxy_answer.py

@@ -0,0 +1,27 @@
+"""The type a collector answer is served with from the site's own domain,
+against the cases every client shares: sdk/protocols/proxy-answer-cases.json."""
+import json
+import os
+import unittest
+
+from analytics_platform.proxy import Proxy, answer_type
+
+CASES = os.path.join(os.path.dirname(__file__), "..", "..", "protocols", "proxy-answer-cases.json")
+
+
+class ProxyAnswerCases(unittest.TestCase):
+    def test_shared_cases(self):
+        with open(CASES, encoding="utf-8") as f:
+            cases = json.load(f)["cases"]
+        for case in cases:
+            with self.subTest(type=case["type"]):
+                self.assertEqual(answer_type(case["type"]), case["served"])
+
+    def test_nosniff_and_only_cache_and_retry(self):
+        upstream = {"Content-Type": "text/html", "Cache-Control": "no-store", "Set-Cookie": "a=b", "Refresh": "0;url=x"}
+        self.assertEqual(Proxy._answer_headers(upstream), [
+            ("Content-Type", "text/plain; charset=utf-8"), ("X-Content-Type-Options", "nosniff"), ("Cache-Control", "no-store")])
+
+
+if __name__ == "__main__":
+    unittest.main()