SPDT/sapl - sapl - Gitea: Git with a cup of tea

5875 Commits

62 Branches

269 Tags

232 MiB

Tree: 917e7e4106

Commit Graph

Author	SHA1	Message	Date
Edward Ribeiro	917e7e4106	Phase 6: scanner probe blocking, plan consolidation, and flow diagram Code: - Block IPs dynamically on scanner extension probes (.php, .asp, .aspx, .jsp, .cgi, .env) — writes rl:ip:{ip}:blocked on first hit; subsequent requests short-circuit at check 2 with zero counting overhead - Add RATE_LIMIT_SCANNER_EXTENSIONS setting (space-separated, env-overridable) - Import os in ratelimit.py for os.path.splitext Plan (RATE_LIMITER_PLAN.md → RATE-LIMITER-PLAN.md): - Rename to kebab-case for consistency with rate-limiter-v2.md - Merge missing content from rate-limiter-v2.md: context & problem statement, component diagram (DB0/DB1 split), decision log, Gunicorn tuning, nginx real-IP fixes, upload settings, N+1 fix (synced to actual implementation), enforcement graduation order, decorator migration table, file serving decision matrix, dynamic page caching guidelines, open questions - Add Mermaid decision flow diagram for RateLimitMiddleware._evaluate() - Add rationale section for rl:{ns}:ip:{ip}:w:{bucket} namespace scoping (5 arguments covering attack pattern match, gaming resistance, key orthogonality, multi-portal fairness, and isolation contract) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	1 month ago
Edward Ribeiro	bea9d84373	Phase 5: X-Accel-Redirect for /media/, UA Redis deny list, per-path counters nginx: - /media/ proxied through Gunicorn (sapl_general rate limit) instead of direct alias — Django middleware now runs on every media request - /_accel/media/ internal location serves file bytes via X-Accel-Redirect sapl/base/media.py (new): - serve_media() gate: path traversal guard, auth redirect for documentos_privados/, per-path Redis counter, content-type metadata cache, X-Accel-Redirect response; falls back to Django serve() in DEBUG sapl/middleware/ratelimit.py: - RL_PATH_REQUESTS, RL_UA_BLOCKLIST, FILE_META_KEY constants - _incr_with_ttl() extracted to module level (reused by media.py) - Runtime UA deny list: _refresh_ua_blocklist() fetches rl:bot:ua:blocked SET from Redis (SMEMBERS, cached per worker, TTL=RATE_LIMITER_UA_BLOCKLIST_REFRESH); _is_redis_blocked_ua() tokenises UA and checks sha256 of each token sapl/settings.py: - RATE_LIMITER_UA_BLOCKLIST_REFRESH, MEDIA_PATH_COUNTER_TTL, MEDIA_FILE_CACHE_TTL added (all env-tunable via config()) plan/RATE_LIMITER_PLAN.md: - Key schema table updated; media file serving section added; decision flow documented; UA deny list seed section expanded Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	1 month ago

Author

SHA1

Message

Date

Edward Ribeiro

917e7e4106

Phase 6: scanner probe blocking, plan consolidation, and flow diagram

Code:
- Block IPs dynamically on scanner extension probes (.php, .asp, .aspx,
  .jsp, .cgi, .env) — writes rl:ip:{ip}:blocked on first hit; subsequent
  requests short-circuit at check 2 with zero counting overhead
- Add RATE_LIMIT_SCANNER_EXTENSIONS setting (space-separated, env-overridable)
- Import os in ratelimit.py for os.path.splitext

Plan (RATE_LIMITER_PLAN.md → RATE-LIMITER-PLAN.md):
- Rename to kebab-case for consistency with rate-limiter-v2.md
- Merge missing content from rate-limiter-v2.md: context & problem statement,
  component diagram (DB0/DB1 split), decision log, Gunicorn tuning, nginx
  real-IP fixes, upload settings, N+1 fix (synced to actual implementation),
  enforcement graduation order, decorator migration table, file serving
  decision matrix, dynamic page caching guidelines, open questions
- Add Mermaid decision flow diagram for RateLimitMiddleware._evaluate()
- Add rationale section for rl:{ns}:ip:{ip}:w:{bucket} namespace scoping
  (5 arguments covering attack pattern match, gaming resistance, key
  orthogonality, multi-portal fairness, and isolation contract)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 month ago

Edward Ribeiro

bea9d84373

Phase 5: X-Accel-Redirect for /media/, UA Redis deny list, per-path counters

nginx:
- /media/ proxied through Gunicorn (sapl_general rate limit) instead of
  direct alias — Django middleware now runs on every media request
- /_accel/media/ internal location serves file bytes via X-Accel-Redirect

sapl/base/media.py (new):
- serve_media() gate: path traversal guard, auth redirect for
  documentos_privados/, per-path Redis counter, content-type metadata
  cache, X-Accel-Redirect response; falls back to Django serve() in DEBUG

sapl/middleware/ratelimit.py:
- RL_PATH_REQUESTS, RL_UA_BLOCKLIST, FILE_META_KEY constants
- _incr_with_ttl() extracted to module level (reused by media.py)
- Runtime UA deny list: _refresh_ua_blocklist() fetches rl:bot:ua:blocked
  SET from Redis (SMEMBERS, cached per worker, TTL=RATE_LIMITER_UA_BLOCKLIST_REFRESH);
  _is_redis_blocked_ua() tokenises UA and checks sha256 of each token

sapl/settings.py:
- RATE_LIMITER_UA_BLOCKLIST_REFRESH, MEDIA_PATH_COUNTER_TTL,
  MEDIA_FILE_CACHE_TTL added (all env-tunable via config())

plan/RATE_LIMITER_PLAN.md:
- Key schema table updated; media file serving section added;
  decision flow documented; UA deny list seed section expanded

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 month ago

2 Commits (917e7e4106a9eb4298a29ff33b50d2e044082ac2)