sycommon-python-lib 0.2.8a4__tar.gz → 0.2.8a5__tar.gz

{sycommon_python_lib-0.2.8a4 → sycommon_python_lib-0.2.8a5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sycommon-python-lib
-Version: 0.2.8a4
+Version: 0.2.8a5
 Summary: Add your description here
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown

{sycommon_python_lib-0.2.8a4 → sycommon_python_lib-0.2.8a5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sycommon-python-lib"
-version = "0.2.8a4"
+version = "0.2.8a5"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.11"

{sycommon_python_lib-0.2.8a4 → sycommon_python_lib-0.2.8a5}/src/sycommon/middleware/sandbox.py

@@ -971,6 +971,20 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
         env["TEMP"] = os.path.join(workspace, "tmp")
         env["TMP"] = os.path.join(workspace, "tmp")
         env["SANDBOX_ROOT"] = workspace
+        # 签名型凭据豁免(企微文档机器人):WECOM_DOC_BOT_* 用于【本地 HMAC 签名】
+        # (sign=sha256(secret+bot_id+t+nonce)),签名必须在发起方算,网关无法代注
+        # ——这是收口「零密钥」的已知例外。流量仍走网关(URL 指网关+X-Upstream-Host,
+        # 受白名单/审计管制),只是 secret 必须到脚本手里。仅当凭据包里有才注入。
+        try:
+            from sycommon.middleware.sandbox_gateway import credential_store
+            _c = credential_store().any_user()
+            _creds = credential_store().get(_c) if _c else None
+            for _k in ("WECOM_DOC_BOT_ID", "WECOM_DOC_BOT_SECRET"):
+                _v = (_creds or {}).get(_k)
+                if _v:
+                    env[_k] = str(_v)
+        except Exception:
+            pass
         # 出网网关：子进程 SYT_BASE_URL 指向网关（http://127.0.0.1:port），
         # HTTPS_PROXY 让 requests/httpx/curl/wget 自动走网关。node/裸 socket 不读
         # proxy 的运行时，由后续 seccomp 硬墙兜底（只放行网关 host:port）。

{sycommon_python_lib-0.2.8a4 → sycommon_python_lib-0.2.8a5}/src/sycommon/middleware/sandbox_gateway.py

@@ -116,15 +116,22 @@ def _strip_cred_headers(headers) -> dict:
 
 
 def _apply_credentials(method: str, target_url: str, headers: dict,
-                       creds: dict) -> tuple[str, dict]:
+                       creds: dict, upstream_host: str = "") -> tuple[str, dict]:
     """按目标 host/path 改写 URL（query 注入）+ 注入凭据头。返回 (url, headers)。
 
     网关→真上游的请求构造在此完成。host 路由表见模块 docstring。
+    upstream_host: 请求头 X-Upstream-Host 的值(网关 origin 模式下 URL host 是
+    网关自身,真实目标在该头里)——凭据路由优先按它判定,其次按 URL host。
     """
     host = (urlparse(target_url).hostname or "").lower()
+    # 网关 origin 模式:URL host 是 127.0.0.1(网关),真实目标在 X-Upstream-Host;
+    # 凭据路由按真实目标判定(取两者中非网关地址的那个)。
+    route_host = host
+    if upstream_host:
+        route_host = (urlparse(f"https://{upstream_host}").hostname or "").lower()
 
     # --- SYT 网关：Bearer + X-Sy-Api-Authz + X-Host-Name ---
-    if _match_syt_upstream(host, creds.get("SYT_BASE_URL", "")):
+    if _match_syt_upstream(route_host, creds.get("SYT_BASE_URL", "")):
         token = creds.get("SYT_TOKEN", "")
         if token:
             headers["Authorization"] = f"Bearer {token}"
@@ -137,7 +144,7 @@ def _apply_credentials(method: str, target_url: str, headers: dict,
         return target_url, headers
 
     # --- 企微 gettoken：corpid/corpsecret 在 URL query ---
-    if _is_wecom(host):
+    if _is_wecom(route_host):
         corp_id = creds.get("WECOM_CORP_ID", "")
         corp_secret = creds.get("WECOM_CORP_SECRET", "")
         if corp_id and corp_secret and "/cgi-bin/gettoken" in target_url:
@@ -146,10 +153,12 @@ def _apply_credentials(method: str, target_url: str, headers: dict,
             q.setdefault("corpid", corp_id)
             q.setdefault("corpsecret", corp_secret)
             target_url = urlunparse(parsed._replace(query=urlencode(q)))
+        # 企微文档机器人(wecom.py 的 MCP 网关)用 DOC_BOT 凭据签名——不在此注入
+        # (wecom.py 本地算签名),只保证 gettoken 的 corp 凭据注入。
         return target_url, headers
 
     # --- OA MCP 后端：SYU-Token + SYU-Url（改写为真上游 base）---
-    if _is_oa_backend(host):
+    if _is_oa_backend(route_host):
         token = creds.get("SYT_TOKEN", "")
         syt_base = (creds.get("SYT_BASE_URL") or "").rstrip("/")
         if token:
@@ -412,9 +421,23 @@ class EgressGateway:
         syt_base = (creds.get("SYT_BASE_URL") or "").rstrip("/")
         if upstream_host:
             # SSRF 防护:上游 host 禁止指向回环/本机/私有网段(本机服务含沙箱
-            # 自身 API,免鉴权,打穿即跨用户任意执行)。非回环的 10.x/172.16-31.x/
-            # 192.168.x 内网目标按 EgressPolicy 判定(directAllow 命中才放)。
-            if _is_loopback_or_private(upstream_host):
+            # 自身 API,免鉴权,打穿即跨用户任意执行)。例外:EgressPolicy 里
+            # viaGateway/directAllow 显式登记的【信任内网上游】(如 OA MCP
+            # ai.syitservice.com→10.10.1.171)——它们是内网服务但有意经营,
+            # 不属于 SSRF 攻击面(策略由 _check_allowlist 继续管)。
+            policy = None
+            try:
+                from sycommon.config.EgressPolicyConfig import EgressPolicyConfig
+                policy = EgressPolicyConfig.from_config()
+            except Exception:
+                policy = None
+            trusted = []
+            if policy is not None:
+                trusted = list(policy.viaGateway) + list(policy.directAllow)
+            uh_hostname = upstream_host.split(":")[0] if upstream_host.count(":") <= 1 \
+                else upstream_host
+            if (_is_loopback_or_private(upstream_host)
+                    and not EgressPolicyConfig._host_match(uh_hostname.lower(), trusted)):
                 SYLogger.warning(
                     f"[EgressGateway] 拒绝内网/回环上游(SSRF 防护): {upstream_host}")
                 return web.Response(status=403, text="gateway: upstream host not allowed")
@@ -446,9 +469,11 @@ class EgressGateway:
                 continue
             fwd_headers[k] = v
 
-        # 注入凭据头 / 改写 URL（query 注入）
+        # 注入凭据头 / 改写 URL（query 注入）。
+        # upstream_host 透传给凭据路由:网关 origin 模式下 URL host 是网关自身,
+        # 真实目标在 X-Upstream-Host——OA(ai.sy)/企微按它判路由。
         target_url, fwd_headers = _apply_credentials(
-            request.method, target_url, fwd_headers, creds)
+            request.method, target_url, fwd_headers, creds, upstream_host)
 
         # 读请求体（上传场景）
         body = await request.read() if request.can_read_body else None

{sycommon_python_lib-0.2.8a4 → sycommon_python_lib-0.2.8a5}/src/sycommon_python_lib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sycommon-python-lib
-Version: 0.2.8a4
+Version: 0.2.8a5
 Summary: Add your description here
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown