guard-core 2.0.0__tar.gz → 2.2.0__tar.gz

{guard_core-2.0.0/guard_core.egg-info → guard_core-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: guard-core
-Version: 2.0.0
+Version: 2.2.0
 Summary: Framework-agnostic security engine for the Guard ecosystem.
 Author-email: Renzo Franceschini <rennf93@users.noreply.github.com>
 License: MIT

{guard_core-2.0.0 → guard_core-2.2.0}/guard_core/core/checks/implementations/cloud_ip_refresh.py

@@ -1,7 +1,6 @@
 import time
 
 from guard_core.core.checks.base import SecurityCheck
-from guard_core.handlers.cloud_handler import cloud_handler
 from guard_core.protocols.request_protocol import GuardRequest
 from guard_core.protocols.response_protocol import GuardResponse
 
@@ -15,18 +14,6 @@ class CloudIpRefreshCheck(SecurityCheck):
         if not self.config.block_cloud_providers:
             return None
 
-        providers = self.config.block_cloud_providers
-        has_any_ranges = any(
-            cloud_handler.ip_ranges.get(provider) for provider in providers
-        )
-
-        if self.config.lazy_init and not has_any_ranges:
-            await cloud_handler.refresh_async(
-                providers, ttl=self.config.cloud_ip_refresh_interval
-            )
-            self.middleware.last_cloud_ip_refresh = int(time.time())
-            return None
-
         if (
             time.time() - self.middleware.last_cloud_ip_refresh
             > self.config.cloud_ip_refresh_interval

{guard_core-2.0.0 → guard_core-2.2.0}/guard_core/core/checks/pipeline.py

@@ -46,7 +46,7 @@ class SecurityCheckPipeline:
                         exc_info=True,
                     )
 
-                if hasattr(check.config, "fail_secure") and check.config.fail_secure:
+                if check.config.fail_secure:
                     if check.check_name not in self.muted_check_logs:
                         self.logger.warning(
                             f"Blocking request due to check error "

{guard_core-2.0.0 → guard_core-2.2.0}/guard_core/core/initialization/handler_initializer.py

@@ -1,3 +1,5 @@
+import asyncio
+import logging
 from typing import TYPE_CHECKING, Any
 
 if TYPE_CHECKING:
@@ -26,6 +28,8 @@ class HandlerInitializer:
         self.event_filter: Any = None
         self.enricher: Any = None
         self.behavior_tracker: Any = None
+        self._lazy_init_task: asyncio.Task[None] | None = None
+        self.logger = logging.getLogger("guard_core.core.initialization")
 
     def build_enricher(self) -> Any | None:
         if not self.config.enable_enrichment:
@@ -111,6 +115,23 @@ class HandlerInitializer:
             event_filter=self.event_filter,
         )
 
+    async def _run_lazy_init(self) -> None:
+        try:
+            from guard_core.handlers.cloud_handler import cloud_handler
+
+            if self.config.block_cloud_providers:
+                await cloud_handler.initialize_redis(
+                    self.redis_handler,
+                    self.config.block_cloud_providers,
+                    ttl=self.config.cloud_ip_refresh_interval,
+                )
+            if self.geo_ip_handler is not None:
+                await self.geo_ip_handler.initialize_redis(self.redis_handler)
+        except Exception as e:
+            self.logger.warning(
+                "Lazy background initialization failed: %s", e, exc_info=True
+            )
+
     async def initialize_redis_handlers(self) -> None:
         if not (self.config.enable_redis and self.redis_handler):
             return
@@ -121,25 +142,27 @@ class HandlerInitializer:
         from guard_core.handlers.ipban_handler import ip_ban_manager
         from guard_core.handlers.suspatterns_handler import sus_patterns_handler
 
-        if not self.config.lazy_init and self.config.block_cloud_providers:
-            await cloud_handler.initialize_redis(
-                self.redis_handler,
-                self.config.block_cloud_providers,
-                ttl=self.config.cloud_ip_refresh_interval,
-            )
+        if self.config.cloud_ip_store is not None:
+            cloud_handler.set_store(self.config.cloud_ip_store)
 
-        await ip_ban_manager.initialize_redis(self.redis_handler)
+        if self.config.lazy_init:
+            self._lazy_init_task = asyncio.create_task(self._run_lazy_init())
+        else:
+            if self.config.block_cloud_providers:
+                await cloud_handler.initialize_redis(
+                    self.redis_handler,
+                    self.config.block_cloud_providers,
+                    ttl=self.config.cloud_ip_refresh_interval,
+                )
+            if self.geo_ip_handler is not None:
+                await self.geo_ip_handler.initialize_redis(self.redis_handler)
 
-        if not self.config.lazy_init and self.geo_ip_handler is not None:
-            await self.geo_ip_handler.initialize_redis(self.redis_handler)
+        await ip_ban_manager.initialize_redis(self.redis_handler)
 
         if self.rate_limit_handler is not None:
             await self.rate_limit_handler.initialize_redis(self.redis_handler)
         await sus_patterns_handler.initialize_redis(self.redis_handler)
 
-        if self.config.cloud_ip_store is not None:
-            cloud_handler.set_store(self.config.cloud_ip_store)
-
     async def initialize_agent_for_handlers(self) -> None:
         telemetry = self.composite_handler or self.agent_handler
         if telemetry is None:

{guard_core-2.0.0 → guard_core-2.2.0}/guard_core/decorators/access_control.py

@@ -1,7 +1,7 @@
 from collections.abc import Callable
 from typing import Any
 
-from guard_core.decorators.base import BaseSecurityMixin
+from guard_core.decorators.base import BaseSecurityMixin, DecoratedFunction
 
 
 class AccessControlMixin(BaseSecurityMixin):
@@ -9,8 +9,8 @@ class AccessControlMixin(BaseSecurityMixin):
         self,
         whitelist: list[str] | None = None,
         blacklist: list[str] | None = None,
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
             if whitelist:
                 route_config.ip_whitelist = whitelist
@@ -22,8 +22,8 @@ class AccessControlMixin(BaseSecurityMixin):
 
     def block_countries(
         self, countries: list[str]
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
             route_config.blocked_countries = countries
             return self._apply_route_config(func)
@@ -32,8 +32,8 @@ class AccessControlMixin(BaseSecurityMixin):
 
     def allow_countries(
         self, countries: list[str]
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
             route_config.whitelist_countries = countries
             return self._apply_route_config(func)
@@ -42,8 +42,8 @@ class AccessControlMixin(BaseSecurityMixin):
 
     def block_clouds(
         self, providers: list[str] | None = None
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
             if providers is None:
                 route_config.block_cloud_providers = {"AWS", "GCP", "Azure"}
@@ -55,8 +55,8 @@ class AccessControlMixin(BaseSecurityMixin):
 
     def bypass(
         self, checks: list[str]
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
             route_config.bypassed_checks.update(checks)
             return self._apply_route_config(func)

{guard_core-2.0.0 → guard_core-2.2.0}/guard_core/decorators/advanced.py

@@ -3,7 +3,7 @@ from collections.abc import Callable, MutableMapping
 from typing import Any
 from urllib.parse import parse_qs
 
-from guard_core.decorators.base import BaseSecurityMixin
+from guard_core.decorators.base import BaseSecurityMixin, DecoratedFunction
 from guard_core.protocols.request_protocol import GuardRequest
 from guard_core.protocols.response_protocol import GuardResponse
 
@@ -30,8 +30,8 @@ class _SimpleResponse:
 class AdvancedMixin(BaseSecurityMixin):
     def time_window(
         self, start_time: str, end_time: str, timezone: str = "UTC"
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
             route_config.time_restrictions = {
                 "start": start_time,
@@ -44,8 +44,8 @@ class AdvancedMixin(BaseSecurityMixin):
 
     def suspicious_detection(
         self, enabled: bool = True
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
             route_config.enable_suspicious_detection = enabled
             return self._apply_route_config(func)
@@ -54,8 +54,8 @@ class AdvancedMixin(BaseSecurityMixin):
 
     def honeypot_detection(
         self, trap_fields: list[str]
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             async def honeypot_validator(
                 request: GuardRequest,
             ) -> GuardResponse | None:

{guard_core-2.0.0 → guard_core-2.2.0}/guard_core/decorators/authentication.py

@@ -1,12 +1,12 @@
 from collections.abc import Callable
 from typing import Any
 
-from guard_core.decorators.base import BaseSecurityMixin
+from guard_core.decorators.base import BaseSecurityMixin, DecoratedFunction
 
 
 class AuthenticationMixin(BaseSecurityMixin):
-    def require_https(self) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    def require_https(self) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
             route_config.require_https = True
             return self._apply_route_config(func)
@@ -15,8 +15,8 @@ class AuthenticationMixin(BaseSecurityMixin):
 
     def require_auth(
         self, type: str = "bearer"
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
             route_config.auth_required = type
             return self._apply_route_config(func)
@@ -25,8 +25,8 @@ class AuthenticationMixin(BaseSecurityMixin):
 
     def api_key_auth(
         self, header_name: str = "X-API-Key"
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
             route_config.api_key_required = True
             route_config.required_headers[header_name] = "required"
@@ -36,8 +36,8 @@ class AuthenticationMixin(BaseSecurityMixin):
 
     def require_headers(
         self, headers: dict[str, str]
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
             route_config.required_headers.update(headers)
             return self._apply_route_config(func)

{guard_core-2.0.0 → guard_core-2.2.0}/guard_core/decorators/base.py

@@ -1,12 +1,19 @@
 from collections.abc import Callable
 from datetime import datetime, timezone
-from typing import Any
+from typing import Any, Protocol, cast, runtime_checkable
 
 from guard_core.handlers.behavior_handler import BehaviorRule, BehaviorTracker
 from guard_core.models import SecurityConfig
 from guard_core.protocols.request_protocol import GuardRequest
 
 
+@runtime_checkable
+class DecoratedFunction(Protocol):
+    _guard_route_id: str
+
+    def __call__(self, *args: Any, **kwargs: Any) -> Any: ...
+
+
 class RouteConfig:
     def __init__(self) -> None:
         self.rate_limit: int | None = None
@@ -41,7 +48,7 @@ class BaseSecurityMixin:
     def _ensure_route_config(self, func: Callable[..., Any]) -> RouteConfig:
         raise NotImplementedError("This mixin must be used with BaseSecurityDecorator")
 
-    def _apply_route_config(self, func: Callable[..., Any]) -> Callable[..., Any]:
+    def _apply_route_config(self, func: Callable[..., Any]) -> "DecoratedFunction":
         raise NotImplementedError("This mixin must be used with BaseSecurityDecorator")
 
 
@@ -68,10 +75,10 @@ class BaseSecurityDecorator:
             self._route_configs[route_id] = config
         return self._route_configs[route_id]
 
-    def _apply_route_config(self, func: Callable[..., Any]) -> Callable[..., Any]:
+    def _apply_route_config(self, func: Callable[..., Any]) -> DecoratedFunction:
         route_id = self._get_route_id(func)
-        func._guard_route_id = route_id  # type: ignore[attr-defined]
-        return func
+        cast(Any, func)._guard_route_id = route_id
+        return cast(DecoratedFunction, func)
 
     async def initialize_behavior_tracking(self, redis_handler: Any = None) -> None:
         if redis_handler:

{guard_core-2.0.0 → guard_core-2.2.0}/guard_core/decorators/behavioral.py

@@ -1,7 +1,7 @@
 from collections.abc import Callable
 from typing import Any, Literal
 
-from guard_core.decorators.base import BaseSecurityMixin
+from guard_core.decorators.base import BaseSecurityMixin, DecoratedFunction
 from guard_core.handlers.behavior_handler import BehaviorRule
 
 
@@ -11,8 +11,8 @@ class BehavioralMixin(BaseSecurityMixin):
         max_calls: int,
         window: int = 3600,
         action: Literal["ban", "log", "throttle", "alert"] = "ban",
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
 
             rule = BehaviorRule(
@@ -29,8 +29,8 @@ class BehavioralMixin(BaseSecurityMixin):
         max_occurrences: int,
         window: int = 86400,
         action: Literal["ban", "log", "throttle", "alert"] = "ban",
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
 
             rule = BehaviorRule(
@@ -47,8 +47,8 @@ class BehavioralMixin(BaseSecurityMixin):
 
     def behavior_analysis(
         self, rules: list[BehaviorRule]
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
             route_config.behavior_rules.extend(rules)
             return self._apply_route_config(func)
@@ -60,8 +60,8 @@ class BehavioralMixin(BaseSecurityMixin):
         max_frequency: float,
         window: int = 300,
         action: Literal["ban", "log", "throttle", "alert"] = "ban",
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
             max_calls = int(max_frequency * window)
 

{guard_core-2.0.0 → guard_core-2.2.0}/guard_core/decorators/content_filtering.py

@@ -1,7 +1,7 @@
 from collections.abc import Awaitable, Callable
 from typing import Any
 
-from guard_core.decorators.base import BaseSecurityMixin
+from guard_core.decorators.base import BaseSecurityMixin, DecoratedFunction
 from guard_core.protocols.request_protocol import GuardRequest
 from guard_core.protocols.response_protocol import GuardResponse
 
@@ -9,8 +9,8 @@ from guard_core.protocols.response_protocol import GuardResponse
 class ContentFilteringMixin(BaseSecurityMixin):
     def block_user_agents(
         self, patterns: list[str]
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
             route_config.blocked_user_agents.extend(patterns)
             return self._apply_route_config(func)
@@ -19,8 +19,8 @@ class ContentFilteringMixin(BaseSecurityMixin):
 
     def content_type_filter(
         self, allowed_types: list[str]
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
             route_config.allowed_content_types = allowed_types
             return self._apply_route_config(func)
@@ -29,8 +29,8 @@ class ContentFilteringMixin(BaseSecurityMixin):
 
     def max_request_size(
         self, size_bytes: int
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
             route_config.max_request_size = size_bytes
             return self._apply_route_config(func)
@@ -39,8 +39,8 @@ class ContentFilteringMixin(BaseSecurityMixin):
 
     def require_referrer(
         self, allowed_domains: list[str]
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
             route_config.require_referrer = allowed_domains
             return self._apply_route_config(func)
@@ -50,8 +50,8 @@ class ContentFilteringMixin(BaseSecurityMixin):
     def custom_validation(
         self,
         validator: Callable[[GuardRequest], Awaitable[GuardResponse | None]],
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
             route_config.custom_validators.append(validator)
             return self._apply_route_config(func)
@@ -64,8 +64,8 @@ class ContentFilteringMixin(BaseSecurityMixin):
         params: set[str] | None = None,
         body_fields: set[str] | None = None,
         categories: set[str] | None = None,
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
             if headers is not None:
                 route_config.excluded_detection_headers = set(headers)

{guard_core-2.0.0 → guard_core-2.2.0}/guard_core/decorators/rate_limiting.py

@@ -1,14 +1,14 @@
 from collections.abc import Callable
 from typing import Any
 
-from guard_core.decorators.base import BaseSecurityMixin
+from guard_core.decorators.base import BaseSecurityMixin, DecoratedFunction
 
 
 class RateLimitingMixin(BaseSecurityMixin):
     def rate_limit(
         self, requests: int, window: int = 60
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
             route_config.rate_limit = requests
             route_config.rate_limit_window = window
@@ -18,8 +18,8 @@ class RateLimitingMixin(BaseSecurityMixin):
 
     def geo_rate_limit(
         self, limits: dict[str, tuple[int, int]]
-    ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
-        def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+    ) -> Callable[[Callable[..., Any]], DecoratedFunction]:
+        def decorator(func: Callable[..., Any]) -> DecoratedFunction:
             route_config = self._ensure_route_config(func)
             route_config.geo_rate_limits = limits
             return self._apply_route_config(func)

{guard_core-2.0.0 → guard_core-2.2.0}/guard_core/detection_engine/compiler.py

@@ -21,7 +21,7 @@ class PatternCompiler:
     async def compile_pattern(
         self, pattern: str, flags: int = re.IGNORECASE | re.MULTILINE
     ) -> re.Pattern:
-        cache_key = f"{hash(pattern)}:{flags}"
+        cache_key = f"{pattern}:{flags}"
 
         if cache_key in self._compiled_cache:
             async with self._lock:

{guard_core-2.0.0 → guard_core-2.2.0}/guard_core/detection_engine/preprocessor.py

@@ -1,3 +1,4 @@
+import binascii
 import re
 import unicodedata
 from typing import Any
@@ -26,7 +27,7 @@ class ContentPreprocessor:
             r"eval\s*\(",
             r"exec\s*\(",
             r"system\s*\(",
-            r"<?php",
+            r"<\?php",
             r"<%",
             r"{{",
             r"{%",
@@ -44,6 +45,20 @@ class ContentPreprocessor:
             re.compile(pattern, re.IGNORECASE) for pattern in self.attack_indicators
         ]
 
+    _BASE64_RE = re.compile(
+        r"(?<![A-Za-z0-9+/])[A-Za-z0-9+/]{20,}={0,2}(?![A-Za-z0-9+/=])"
+    )
+    _HEX_ESCAPE_RE = re.compile(r"\\x([0-9a-fA-F]{2})")
+    _UNICODE_ESCAPE_RE = re.compile(r"\\u([0-9a-fA-F]{4})")
+    _SQL_BLOCK_COMMENT_INNER_UPPER_RE = re.compile(
+        r"(?<=[A-Z])/\*.*?\*/(?=[A-Z])", re.DOTALL
+    )
+    _SQL_BLOCK_COMMENT_INNER_LOWER_RE = re.compile(
+        r"(?<=[a-z])/\*.*?\*/(?=[a-z])", re.DOTALL
+    )
+    _SQL_BLOCK_COMMENT_RE = re.compile(r"/\*.*?\*/", re.DOTALL)
+    _SQL_LINE_COMMENT_RE = re.compile(r"(--|#)[^\n]*")
+
     async def _send_preprocessor_event(
         self,
         event_type: str,
@@ -174,32 +189,25 @@ class ContentPreprocessor:
 
         return result
 
-    def _add_non_attack_content(
-        self,
-        content: str,
-        attack_regions: list[tuple[int, int]],
-        result_parts: list[str],
-        remaining: int,
-    ) -> None:
-        last_end = 0
-        for start, end in attack_regions:
-            if last_end < start and remaining > 0:
-                chunk_len = min(start - last_end, remaining)
-                result_parts.insert(0, content[last_end : last_end + chunk_len])
-                remaining -= chunk_len
-            last_end = end
-
     def _build_result_with_attack_regions_and_context(
         self, content: str, attack_regions: list[tuple[int, int]]
     ) -> str:
         attack_length = sum(end - start for start, end in attack_regions)
-        result_parts = []
-        remaining = self.max_content_length - attack_length
+        gap_budget = self.max_content_length - attack_length
+        result_parts: list[str] = []
+        last_end = 0
 
         for start, end in attack_regions:
+            if last_end < start and gap_budget > 0:
+                chunk_len = min(start - last_end, gap_budget)
+                result_parts.append(content[last_end : last_end + chunk_len])
+                gap_budget -= chunk_len
             result_parts.append(content[start:end])
+            last_end = end
 
-        self._add_non_attack_content(content, attack_regions, result_parts, remaining)
+        if last_end < len(content) and gap_budget > 0:
+            tail_len = min(len(content) - last_end, gap_budget)
+            result_parts.append(content[last_end : last_end + tail_len])
 
         return "".join(result_parts)
 
@@ -231,6 +239,50 @@ class ContentPreprocessor:
         translator = str.maketrans("", "", control_chars)
         return content.translate(translator)
 
+    def _decode_base64_candidates(self, content: str) -> str:
+        import base64
+
+        def _replace(match: re.Match[str]) -> str:
+            token = match.group(0)
+            padding = (4 - len(token) % 4) % 4
+            padded = token + "=" * padding
+            try:
+                decoded = base64.b64decode(padded, validate=True).decode(
+                    "utf-8", errors="ignore"
+                )
+            except (ValueError, binascii.Error):
+                return token
+            if decoded and any(c.isprintable() for c in decoded):
+                return decoded
+            return token
+
+        return self._BASE64_RE.sub(_replace, content)
+
+    def _decode_hex_escapes(self, content: str) -> str:
+        def _replace(match: re.Match[str]) -> str:
+            try:
+                return chr(int(match.group(1), 16))
+            except ValueError:
+                return match.group(0)
+
+        return self._HEX_ESCAPE_RE.sub(_replace, content)
+
+    def _decode_unicode_escapes(self, content: str) -> str:
+        def _replace(match: re.Match[str]) -> str:
+            try:
+                return chr(int(match.group(1), 16))
+            except ValueError:
+                return match.group(0)
+
+        return self._UNICODE_ESCAPE_RE.sub(_replace, content)
+
+    def _strip_sql_comments(self, content: str) -> str:
+        content = self._SQL_BLOCK_COMMENT_INNER_UPPER_RE.sub("", content)
+        content = self._SQL_BLOCK_COMMENT_INNER_LOWER_RE.sub("", content)
+        content = self._SQL_BLOCK_COMMENT_RE.sub(" ", content)
+        content = self._SQL_LINE_COMMENT_RE.sub(" ", content)
+        return content
+
     async def decode_common_encodings(self, content: str) -> str:
         max_decode_iterations = 3
         iterations = 0
@@ -268,11 +320,16 @@ class ContentPreprocessor:
                     error_type="html_decode",
                 )
 
+            content = self._decode_hex_escapes(content)
+            content = self._decode_unicode_escapes(content)
+            content = self._decode_base64_candidates(content)
+
             if content == original:
                 break
 
             iterations += 1
 
+        content = self._strip_sql_comments(content)
         return content
 
     async def preprocess(self, content: str) -> str:

{guard_core-2.0.0/guard_core/sync → guard_core-2.2.0/guard_core}/handlers/__init__.py

@@ -1,5 +1,6 @@
 from .behavior_handler import BehaviorTracker
 from .cloud_handler import CloudManager
+from .cors_handler import CorsHandler, CorsPreflightResponse, is_preflight
 from .dynamic_rule_handler import DynamicRuleManager
 from .ipban_handler import IPBanManager
 from .ipinfo_handler import IPInfoManager
@@ -11,6 +12,8 @@ from .suspatterns_handler import SusPatternsManager
 __all__ = [
     "BehaviorTracker",
     "CloudManager",
+    "CorsHandler",
+    "CorsPreflightResponse",
     "DynamicRuleManager",
     "IPBanManager",
     "IPInfoManager",
@@ -18,4 +21,5 @@ __all__ = [
     "RedisManager",
     "SecurityHeadersManager",
     "SusPatternsManager",
+    "is_preflight",
 ]