From 436c09fb90dd1de97982ef3fc021878057a40a07 Mon Sep 17 00:00:00 2001 From: Kris <2893855659@qq.com> Date: Sat, 13 Jun 2026 18:54:01 +0800 Subject: [PATCH] =?UTF-8?q?refactor(ssrf):=20=E4=BC=98=E5=8C=96SSRF?= =?UTF-8?q?=E7=AD=96=E7=95=A5=E7=9A=84=E4=B8=BB=E6=9C=BA=E5=90=8D=E5=8C=B9?= =?UTF-8?q?=E9=85=8D=E9=80=BB=E8=BE=91?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 将主机名拦截规则从直接使用原始配置改为使用预归一化后的数据，提升匹配效率和一致性 --- backend/package/yuxi/utils/net_security.py | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/backend/package/yuxi/utils/net_security.py b/backend/package/yuxi/utils/net_security.py index 4167fbc3..084f07f7 100644 --- a/backend/package/yuxi/utils/net_security.py +++ b/backend/package/yuxi/utils/net_security.py @@ -76,6 +76,8 @@ class SSRFPolicy(BaseModel): _blocked_networks: list[ipaddress.IPv4Network | ipaddress.IPv6Network] = PrivateAttr(default_factory=list) _blocked_domains_normalized: set[str] = PrivateAttr(default_factory=set) + _blocked_hostnames_normalized: set[str] = PrivateAttr(default_factory=set) + _blocked_hostname_suffixes_normalized: list[str] = PrivateAttr(default_factory=list) model_config = {"arbitrary_types_allowed": True} @@ -86,6 +88,12 @@ class SSRFPolicy(BaseModel): self._blocked_domains_normalized = { _normalize_hostname(d) for d in self.blocked_domains } + self._blocked_hostnames_normalized = { + _normalize_hostname(h) for h in self.blocked_hostnames + } + self._blocked_hostname_suffixes_normalized = [ + _normalize_hostname(s) for s in self.blocked_hostname_suffixes + ] class SSRFBlockedError(Exception): @@ -109,9 +117,9 @@ def _is_blocked_hostname(hostname: str, policy: SSRFPolicy) -> bool: normalized = _normalize_hostname(hostname) if not normalized: return True # fail-closed - if normalized in policy.blocked_hostnames: + if normalized in policy._blocked_hostnames_normalized: return True - return any(normalized.endswith(suffix) for suffix in policy.blocked_hostname_suffixes) + return any(normalized.endswith(suffix) for suffix in policy._blocked_hostname_suffixes_normalized) def _matches_domain_pattern(hostname: str, pattern: str) -> bool: