Repository navigation
feat: 接入 ModSecurity + OWASP CRS 反向代理 WAF 并自动供给配置 - #216
Merged
Merged
Conversation
Flask 进程内没有可用的开源 WAF 引擎，改为业界轻量方案 nginx + ModSecurity + OWASP CoreRuleSet：攻击流量在进 Flask 前拦掉，与应用内 Flask-Limiter 构成纵深 防御。可自动化的部分（规则集下载 + 配置生成）由 python -m app 启动时完成， gunicorn / Lambda 用 python -m app.core.waf [--refresh] 手动供给，避免多 worker 重复下载。 - 新增 app/core/waf.py：CRS 下载仅放行 https，版本 + SHA256 双锁定，校验失败 即丢弃并保留已装版本；tar 解压做穿越/软链/设备文件/体积与文件数上限防护且 不复用权限位；生成 modsecurity.conf、crs-setup.conf、exclusions.conf、 standalone nginx.conf 与 conf.d 片段，custom.conf 只生成一次不覆盖。 - 安全边界：不装系统包、不执行下载到的二进制、默认不 reload nginx （waf.auto_reload 显式开启才做）；写入 nginx 配置的 listen / server_name / upstream 经白名单校验防指令注入；引擎缺失、下载失败、nginx -t 不通过都不 阻断应用启动，只在启动输出里给出原因与下一步命令。 - 内容型端点（笔记正文/导入/组织笔记/犇犇/评论/待办/图床附件）默认按 tag 排除 注入类规则：粘贴 SQL/JS/shell 是本站核心用法且正文渲染前都过 bleach；协议 强制(920)、方法强制(911)、扫描器识别(913) 仍全程生效。 - 修复两处会真炸的问题：笔记正文走 request.form 属 ModSecurity「无文件请求体」， SecRequestBodyNoFilesLimit 沿用默认 128KB 会让保存大笔记在进 Flask 前就 413； nginx -t 失败时仍上报 ready=true。 - config.json 新增 waf 段（默认 enabled=false），锁定 CRS v4.29.0；反代后必须 trust_proxy_headers=true 且 trusted_proxies 覆盖回源地址，否则全站每 IP 限流 会把所有用户算成同一个 IP，供给时主动告警。 - tests/test_waf.py 39 个离线用例（网络与子进程均由 monkeypatch 替换）， 全量 pytest tests/ 198 passed；README 与 AGENTS.md 补充部署与安全约定。
Closed
2 of 6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.