bivashy/Blitz-Proxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

better security

Browse Source
This commit is contained in:
Whispering Wind
2024-08-11 23:34:25 +03:30
committed by GitHub
parent 205bcdf1a6
commit 571d59bd37
1 changed files with 17 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
core/scripts/singbox/singbox.py
View File

@ -7,16 +7,16 @@ from aiohttp.web_middlewares import middleware
from urllib.parse import unquote, parse_qs from urllib.parse import unquote, parse_qs
import re import re
import time import time
import shlex
from dotenv import load_dotenv from dotenv import load_dotenv
load_dotenv() load_dotenv()
# Environment variables # Environment variables
DOMAIN = os.getenv('DOMAIN') DOMAIN = os.getenv('hysteria_DOMAIN')
CERTFILE = os.getenv('CERTFILE') CERTFILE = os.getenv('hysteria_CERTFILE')
KEYFILE = os.getenv('KEYFILE') KEYFILE = os.getenv('hysteria_KEYFILE')
PORT = int(os.getenv('PORT', '3324')) PORT = int(os.getenv('hysteria_PORT', '3324'))
RATE_LIMIT = 100 RATE_LIMIT = 100
RATE_LIMIT_WINDOW = 60 RATE_LIMIT_WINDOW = 60
@ -45,7 +45,7 @@ async def rate_limit_middleware(request, handler):
def sanitize_input(value, pattern): def sanitize_input(value, pattern):
if not re.match(pattern, value): if not re.match(pattern, value):
raise ValueError(f"Invalid value: {value}") raise ValueError(f"Invalid value: {value}")
return value return shlex.quote(value)
async def handle(request): async def handle(request):
try: try:
@ -74,7 +74,17 @@ async def handle(request):
def generate_singbox_config(username, ip_version, fragment): def generate_singbox_config(username, ip_version, fragment):
try: try:
command = ['python3', '/etc/hysteria/core/cli.py', 'show-user-uri', '-u', username, '-ip', ip_version] username = sanitize_input(username, r'^[a-zA-Z0-9_-]+$')
ip_version = sanitize_input(ip_version, r'^[46]$')
command = [
'python3',
'/etc/hysteria/core/cli.py',
'show-user-uri',
'-u', username,
'-ip', ip_version
]
uri = subprocess.check_output(command).decode().strip() uri = subprocess.check_output(command).decode().strip()
except subprocess.CalledProcessError: except subprocess.CalledProcessError:
raise RuntimeError("Failed to get URI.") raise RuntimeError("Failed to get URI.")
@ -145,7 +155,6 @@ async def handle_404(request):
print(f"404 Not Found: {request.path}") print(f"404 Not Found: {request.path}")
return web.Response(status=404, text="Not Found") return web.Response(status=404, text="Not Found")
if __name__ == '__main__': if __name__ == '__main__':
app = web.Application(middlewares=[rate_limit_middleware]) app = web.Application(middlewares=[rate_limit_middleware])