15c89c9038
- App FastAPI (main.py, app/): rotas /health e /dados_retorno, middleware anti-scanner, logging configurado - Config via configs.json (Pydantic); segredos fora do codigo e do git (.gitignore) - Dockerfile (oracledb thin, HEALTHCHECK) + requirements.txt + .dockerignore - Deploy Podman/Quadlet + Caddy em deploy/ - Docs: CLAUDE.md + docs/ (arquitetura, deploy, known-issues) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
45 lines
1.1 KiB
Python
45 lines
1.1 KiB
Python
import re
|
|
|
|
from fastapi import Request, status
|
|
from fastapi.responses import Response
|
|
|
|
BLOCKED_PATHS = {
|
|
"/",
|
|
"/metrics",
|
|
"/security.txt",
|
|
"/.env",
|
|
"/wp-admin",
|
|
"/wp-login.php",
|
|
"/admin",
|
|
"/config",
|
|
"/actuator",
|
|
"/nice%20ports%2C/Trinity.txt.bak",
|
|
}
|
|
|
|
BLOCKED_UA_PATTERNS = re.compile(
|
|
r"(nmap|nikto|masscan|zgrab|censys|shodan|nuclei|httpx|gobuster|dirbuster)",
|
|
re.IGNORECASE,
|
|
)
|
|
|
|
|
|
async def block_scanners(request: Request, call_next):
|
|
path = request.url.path
|
|
ua = request.headers.get("user-agent", "")
|
|
|
|
if (
|
|
path.startswith("/v1/")
|
|
or path.startswith("/v2/")
|
|
or path in ("/health", "/dados_retorno", "/token")
|
|
):
|
|
return await call_next(request)
|
|
|
|
if path in BLOCKED_PATHS or path.endswith((".bak", ".env", ".git", ".php")):
|
|
return Response(status_code=status.HTTP_403_FORBIDDEN)
|
|
|
|
if BLOCKED_UA_PATTERNS.search(ua):
|
|
return Response(status_code=status.HTTP_403_FORBIDDEN)
|
|
|
|
if not ua:
|
|
return Response(status_code=status.HTTP_403_FORBIDDEN)
|
|
|
|
return await call_next(request)
|