veilrender 0.3.0__tar.gz → 0.3.1__tar.gz

{veilrender-0.3.0 → veilrender-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: veilrender
-Version: 0.3.0
+Version: 0.3.1
 Summary: Headless browser rendering API — self-hostable on HF Spaces, Docker, or bare metal
 Author: Peng Ding
 License-Expression: MIT

{veilrender-0.3.0 → veilrender-0.3.1}/src/veilrender/__init__.py

@@ -1,3 +1,3 @@
 """VeilRender — headless browser rendering API."""
 
-__version__ = "0.3.0"
+__version__ = "0.3.1"

{veilrender-0.3.0 → veilrender-0.3.1}/src/veilrender/app.py

@@ -37,7 +37,9 @@ async def _pipe(source: asyncio.StreamReader, dest: asyncio.StreamReader) -> Non
 
 def create_app() -> App:
     """Create and configure the VeilRender application."""
-    app = App(max_body_size=10 * 1024 * 1024)  # 10 MB
+    app = App(
+        max_body_size=64 * 1024
+    )  # 64 KB — render/screenshot payloads are small JSON
 
     # Register routes
     health.register(app)

veilrender-0.3.1/src/veilrender/auth.py

@@ -0,0 +1,114 @@
+"""Token-based authentication with IP-based rate limiting.
+
+Failed auth attempts are tracked per IP. After 3 failures within a
+rolling window, the IP is banned for a configurable duration.
+"""
+
+from __future__ import annotations
+
+import logging
+import time
+from collections import defaultdict
+
+from veilrender._vendor.httpserver import HTTPException, Request
+from veilrender.config import settings
+
+logger = logging.getLogger(__name__)
+
+# Fail2ban settings
+_MAX_FAILURES = 3
+_WINDOW_SECONDS = 300  # 5 minute rolling window
+_BAN_SECONDS = 600  # 10 minute ban
+
+# State: per-IP failure timestamps and ban expiry
+_failures: dict[str, list[float]] = defaultdict(list)
+_banned: dict[str, float] = {}
+
+
+def _get_client_ip(request: Request) -> str:
+    """Extract client IP, respecting X-Forwarded-For behind reverse proxy."""
+    forwarded = request.headers.get("x-forwarded-for", "")
+    if forwarded:
+        # Take the first (leftmost) IP — the original client
+        return forwarded.split(",")[0].strip()
+    return request.client_addr[0] if hasattr(request, "client_addr") else "unknown"
+
+
+def _is_banned(ip: str) -> bool:
+    """Check if an IP is currently banned."""
+    ban_until = _banned.get(ip)
+    if ban_until is None:
+        return False
+    if time.monotonic() >= ban_until:
+        del _banned[ip]
+        return False
+    return True
+
+
+def _record_failure(ip: str) -> None:
+    """Record an auth failure and ban if threshold exceeded."""
+    now = time.monotonic()
+
+    # Clean old entries outside the window
+    _failures[ip] = [t for t in _failures[ip] if now - t < _WINDOW_SECONDS]
+    _failures[ip].append(now)
+
+    if len(_failures[ip]) >= _MAX_FAILURES:
+        _banned[ip] = now + _BAN_SECONDS
+        _failures.pop(ip, None)
+        logger.warning(
+            "IP %s banned for %ds after %d auth failures",
+            ip,
+            _BAN_SECONDS,
+            _MAX_FAILURES,
+        )
+
+
+def _clear_failures(ip: str) -> None:
+    """Clear failure history on successful auth."""
+    _failures.pop(ip, None)
+
+
+def verify_token(request: Request) -> None:
+    """Verify the API token from header or query param.
+
+    Checks ``Authorization: Bearer <token>`` header first, then falls
+    back to ``?token=<token>`` query parameter.
+
+    Raises:
+        HTTPException: 403 if IP is banned, 401 if token is invalid,
+            403 if token is missing.
+
+    If ``VEILRENDER_API_TOKEN`` is not configured, auth is disabled.
+    """
+    expected = settings.api_token
+    if expected is None:
+        return
+
+    ip = _get_client_ip(request)
+
+    # Check ban first
+    if _is_banned(ip):
+        raise HTTPException(403, "Temporarily banned due to repeated auth failures")
+
+    # Check Authorization header
+    auth_header = request.headers.get("authorization", "")
+    if auth_header.startswith("Bearer "):
+        token = auth_header[7:].strip()
+        if token == expected:
+            _clear_failures(ip)
+            return
+        _record_failure(ip)
+        raise HTTPException(401, "Invalid token")
+
+    # Check query param
+    token_params = request.query_params.get("token", [])
+    if token_params:
+        if token_params[0] == expected:
+            _clear_failures(ip)
+            return
+        _record_failure(ip)
+        raise HTTPException(401, "Invalid token")
+
+    _record_failure(ip)
+    raise HTTPException(403, "Authentication required")

{veilrender-0.3.0 → veilrender-0.3.1}/src/veilrender/filters.py

@@ -93,7 +93,7 @@ def make_route_handler(blocklist: frozenset[str]):
     async def _handle_route(route: Route) -> None:
         url = route.request.url
         if should_block(url, blocklist):
-            logger.debug("Blocked: %s", url[:200])
+            logger.info("Blocked: %s", url[:200])
             await route.abort("blockedbyclient")
         else:
             await route.continue_()

{veilrender-0.3.0 → veilrender-0.3.1}/src/veilrender/routes/render.py

@@ -21,6 +21,7 @@ from veilrender.models import (
     RenderResponse,
 )
 from veilrender.storage import storage_manager
+from veilrender.url_validator import URLValidationError, validate_url
 
 logger = logging.getLogger(__name__)
 
@@ -72,6 +73,13 @@ def register(app: App) -> None:
             return JSONResponse({"error": "Missing 'url' field"}, status_code=400)
 
         req = RenderRequest.from_dict(data)
+
+        # Validate URL before any processing
+        try:
+            validate_url(req.url)
+        except URLValidationError as exc:
+            return JSONResponse({"error": f"URL rejected: {exc!s}"}, status_code=400)
+
         timeout = req.timeout or settings.timeout
         stats.render.requests += 1
         t0 = time.monotonic()

{veilrender-0.3.0 → veilrender-0.3.1}/src/veilrender/routes/screenshot.py

@@ -11,6 +11,7 @@ from veilrender.auth import verify_token
 from veilrender.browser import browser_manager
 from veilrender.config import settings
 from veilrender.models import ScreenshotRequest
+from veilrender.url_validator import URLValidationError, validate_url
 
 logger = logging.getLogger(__name__)
 
@@ -39,6 +40,17 @@ def register(app: App) -> None:
             )
 
         req = ScreenshotRequest.from_dict(data)
+
+        # Validate URL before any processing
+        try:
+            validate_url(req.url)
+        except URLValidationError as exc:
+            return Response(
+                body=f'{{"error": "URL rejected: {exc!s}"}}'.encode(),
+                status_code=400,
+                content_type="application/json",
+            )
+
         timeout = req.timeout or settings.timeout
         stats.screenshot.requests += 1
         t0 = time.monotonic()

veilrender-0.3.1/src/veilrender/url_validator.py

@@ -0,0 +1,123 @@
+"""URL validation to prevent SSRF, local file reads, and protocol abuse.
+
+Blocks:
+- Non-HTTP(S) schemes: file://, data:, javascript:, ftp://, etc.
+- Private/reserved IP ranges: 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12,
+  192.168.0.0/16, 169.254.0.0/16, ::1, fd00::/8, etc.
+- DNS resolution is checked before navigation to prevent DNS rebinding.
+"""
+
+from __future__ import annotations
+
+import ipaddress
+import logging
+import socket
+from urllib.parse import urlparse
+
+logger = logging.getLogger(__name__)
+
+_ALLOWED_SCHEMES = {"http", "https"}
+
+
+class URLValidationError(Exception):
+    """Raised when a URL fails validation."""
+
+
+def validate_url(url: str) -> str:
+    """Validate and sanitize a URL before passing it to Playwright.
+
+    Args:
+        url: The user-supplied URL to validate.
+
+    Returns:
+        The validated URL (unchanged if valid).
+
+    Raises:
+        URLValidationError: If the URL is unsafe.
+    """
+    if not url or not url.strip():
+        raise URLValidationError("Empty URL")
+
+    parsed = urlparse(url)
+
+    # Scheme check
+    scheme = parsed.scheme.lower()
+    if scheme not in _ALLOWED_SCHEMES:
+        raise URLValidationError(f"Scheme '{scheme}' not allowed (only http/https)")
+
+    # Hostname check
+    hostname = parsed.hostname
+    if not hostname:
+        raise URLValidationError("Missing hostname")
+
+    # Resolve DNS and check against private IP ranges
+    _check_resolved_ips(hostname)
+
+    return url
+
+
+def _check_resolved_ips(hostname: str) -> None:
+    """Resolve hostname and reject private/reserved IP addresses.
+
+    Resolves DNS before Playwright navigates to prevent DNS rebinding
+    attacks where a hostname initially resolves to a public IP but
+    later resolves to a private one.
+
+    Args:
+        hostname: The hostname to check.
+
+    Raises:
+        URLValidationError: If the hostname resolves to a private IP.
+    """
+    # Check if hostname is a raw IP literal
+    try:
+        addr = ipaddress.ip_address(hostname)
+        if _is_blocked_ip(addr):
+            raise URLValidationError(f"IP address {hostname} is in a blocked range")
+        return
+    except ValueError:
+        pass  # Not an IP literal, proceed to DNS resolution
+
+    # Resolve hostname
+    try:
+        results = socket.getaddrinfo(
+            hostname, None, socket.AF_UNSPEC, socket.SOCK_STREAM
+        )
+    except socket.gaierror as exc:
+        raise URLValidationError(
+            f"DNS resolution failed for '{hostname}': {exc}"
+        ) from exc
+
+    if not results:
+        raise URLValidationError(f"No DNS results for '{hostname}'")
+
+    for family, _type, _proto, _canonname, sockaddr in results:
+        ip_str = sockaddr[0]
+        try:
+            addr = ipaddress.ip_address(ip_str)
+            if _is_blocked_ip(addr):
+                raise URLValidationError(
+                    f"'{hostname}' resolves to blocked IP {ip_str}"
+                )
+        except ValueError:
+            continue
+
+
+def _is_blocked_ip(addr: ipaddress.IPv4Address | ipaddress.IPv6Address) -> bool:
+    """Check if an IP address is in a blocked range.
+
+    Blocks:
+        - Loopback (127.0.0.0/8, ::1)
+        - Private networks (10/8, 172.16/12, 192.168/16)
+        - Link-local (169.254/16, fe80::/10)
+        - Unique local (fd00::/8)
+        - Multicast, reserved, unspecified
+    """
+    return (
+        addr.is_loopback
+        or addr.is_private
+        or addr.is_reserved
+        or addr.is_multicast
+        or addr.is_link_local
+        or addr.is_unspecified
+    )

{veilrender-0.3.0 → veilrender-0.3.1}/src/veilrender.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: veilrender
-Version: 0.3.0
+Version: 0.3.1
 Summary: Headless browser rendering API — self-hostable on HF Spaces, Docker, or bare metal
 Author: Peng Ding
 License-Expression: MIT

{veilrender-0.3.0 → veilrender-0.3.1}/src/veilrender.egg-info/SOURCES.txt

@@ -11,6 +11,7 @@ src/veilrender/filters.py
 src/veilrender/models.py
 src/veilrender/stats.py
 src/veilrender/storage.py
+src/veilrender/url_validator.py
 src/veilrender.egg-info/PKG-INFO
 src/veilrender.egg-info/SOURCES.txt
 src/veilrender.egg-info/dependency_links.txt

veilrender-0.3.0/src/veilrender/auth.py

@@ -1,39 +0,0 @@
-"""Token-based authentication."""
-
-from __future__ import annotations
-
-from veilrender._vendor.httpserver import HTTPException, Request
-from veilrender.config import settings
-
-
-def verify_token(request: Request) -> None:
-    """Verify the API token from header or query param.
-
-    Checks ``Authorization: Bearer <token>`` header first, then falls
-    back to ``?token=<token>`` query parameter.
-
-    Raises:
-        HTTPException: 401 if token is invalid, 403 if token is missing.
-
-    If ``VEILRENDER_API_TOKEN`` is not configured, auth is disabled.
-    """
-    expected = settings.api_token
-    if expected is None:
-        return
-
-    # Check Authorization header
-    auth_header = request.headers.get("authorization", "")
-    if auth_header.startswith("Bearer "):
-        token = auth_header[7:].strip()
-        if token == expected:
-            return
-        raise HTTPException(401, "Invalid token")
-
-    # Check query param
-    token_params = request.query_params.get("token", [])
-    if token_params:
-        if token_params[0] == expected:
-            return
-        raise HTTPException(401, "Invalid token")
-
-    raise HTTPException(403, "Authentication required")