kris/ForcePilot
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

refactor(ssrf): 优化SSRF策略的主机名匹配逻辑

Browse Source 
将主机名拦截规则从直接使用原始配置改为使用预归一化后的数据，提升匹配效率和一致性
This commit is contained in:
Kris 2026-06-13 18:54:01 +08:00
parent 9ce17c1662
commit 436c09fb90
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
backend/package/yuxi/utils/net_security.py
View File

@ -76,6 +76,8 @@ class SSRFPolicy(BaseModel):
_blocked_networks: list[ipaddress.IPv4Network | ipaddress.IPv6Network] = PrivateAttr(default_factory=list)
_blocked_domains_normalized: set[str] = PrivateAttr(default_factory=set)
_blocked_hostnames_normalized: set[str] = PrivateAttr(default_factory=set)
_blocked_hostname_suffixes_normalized: list[str] = PrivateAttr(default_factory=list)
model_config = {"arbitrary_types_allowed": True}
@ -86,6 +88,12 @@ class SSRFPolicy(BaseModel):
self._blocked_domains_normalized = {
_normalize_hostname(d) for d in self.blocked_domains
}
self._blocked_hostnames_normalized = {
_normalize_hostname(h) for h in self.blocked_hostnames
}
self._blocked_hostname_suffixes_normalized = [
_normalize_hostname(s) for s in self.blocked_hostname_suffixes
]
class SSRFBlockedError(Exception):
@ -109,9 +117,9 @@ def _is_blocked_hostname(hostname: str, policy: SSRFPolicy) -> bool:
normalized = _normalize_hostname(hostname)
if not normalized:
return True # fail-closed
if normalized in policy.blocked_hostnames:
if normalized in policy._blocked_hostnames_normalized:
return True
return any(normalized.endswith(suffix) for suffix in policy.blocked_hostname_suffixes)
return any(normalized.endswith(suffix) for suffix in policy._blocked_hostname_suffixes_normalized)
def _matches_domain_pattern(hostname: str, pattern: str) -> bool: