fix(RatFireWall): repair broken firewall engine, import crash, and silent-no-op rules - #14
Open
sudo-ai-git wants to merge 1 commit into
Conversation
The moreSecureButNotFullySecure proxy was dead end-to-end:
- rules.py failed to import: Rule('...', max_request_size=2048) passed a
kwarg the constructor never accepted (TypeError at module top).
- proxy.py never started: trailing 'proxy.run' was both missing parens and
called a nonexistent method; mitmproxy addons load via a module-level
'addons' list, which was absent.
- matches_request/matches_response returned False on every path except an
exact-lowercase <script>, so the cURL, Set-Cookie, API-key, JWT, Referer
and blacklist-user-agent rules were silent no-ops -- a firewall that
stopped nothing.
- List-valued header rules (User-Agent: [BadBot, EvilBot]) compared a string
to a list and so never matched.
- <script> detection was case-sensitive and exact-only; <SCRIPT> and
<script src=...> bypassed it.
- HorridAPIResponseFirewall raised KeyError on missing Content-Type and
crashed on non-JSON POST/PUT bodies.
This change:
- makes rules.py import cleanly and gives Rule working blocklist
(request_headers/response_headers) AND allowlist (require_headers)
semantics so 'Block ...' and 'Require ...' rules mean what they say,
- replaces 5 name-only placeholder rules with a real block_attack_patterns
detector (SQLi, XSS event handlers, path traversal, command injection,
RFI) hardened against false positives on benign traffic,
- makes <script> detection case- and attribute-tolerant,
- wires proxy.py + firewall.py as proper mitmproxy addons (module-level
'addons') runnable via 'mitmdump -s',
- adds a 35-check regression test (test_firewall.py) that runs without
mitmproxy installed.
Tested: python3 RatFireWall/test_firewall.py -> 35/35 PASS.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's broken and why this fixes it
The
RatFireWallproxy (especiallymoreSecureButNotFullySecure/) had severalbugs that made it dead on arrival:
rules.pyfailed to import.Rule("Block requests with too large request body", max_request_size=2048)passed a keyword the constructor never accepted, so the whole module raisedTypeErrorbefore the proxy could use it.proxy.pynever started. The trailingproxy.runwas missing parentheses and called a methodProxydoesn't have. (Also, mitmproxy addons are loaded via a module-leveladdonslist +mitmdump -s, not run aspython proxy.py.)matches_request/matches_responsereturnedFalseon every path except the exact-lowercase<script>match. So the cURL, Set-Cookie, API-key, JWT, Referer and blacklist-user-agent rules never blocked anything.<script>detection bypassable — case-sensitive and exact-only, so<SCRIPT>and<script src=...>slipped through.HorridAPIResponseFirewallraisedKeyErrorwhen a response had noContent-Type, and crashed on non-JSON POST/PUT bodies.What this PR changes
rules.pyimports cleanly;Rulenow has working blocklist semantics (request_headers/response_headers) and allowlist semantics (require_headers) so "Block ..." and "Require ..." rules mean what their names say.block_attack_patternsrule (SQLi, XSS event handlers, path traversal, command injection, RFI), hardened so it does not false-positive on benign traffic (JSON, URLs, inline code).<script>detection case- and attribute-tolerant.proxy.py+firewall.pyas proper mitmproxy addons (addons = [...],mitmdump -s proxy.py).KeyErroron missingContent-Typeand its crash on non-JSON bodies.test_firewall.py) that runs without mitmproxy installed.readme.mdwith the correct run instructions.Verification
python3 RatFireWall/test_firewall.py→ 35/35 PASS (rules import, proxy 403 behaviour, attack-pattern true positives + false-positive rejection,<script>bypass hardening).Scope note
This is a learning/development firewall, not a production WAF. The attack-signature list is a deliberately conservative subset; I kept the existing security-posture caveats in the README rather than over-claiming.