NTab仓库
fjmwkj
/
searxng
mirror of https://github.com/searxng/searxng
1
0
Fork 0
Files Issues 0 Wiki
Tree: 28ad5e5545
Branches Tags
searxng
/
_modules
/
searx
/
botdetection
/
http_sec_fetch.html

http_sec_fetch.html 17 KB
History Raw

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210 
  1. <!DOCTYPE html>
    2. 

  2. 

  3. <html lang="en" data-content_root="../../../">
    4. 

  4.   <head>
    5. 

  5.     <meta charset="utf-8" />
    6. 

  6.     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    7. 

  7.   <meta name="viewport" content="width=device-width, initial-scale=1">
    8. 

  8.     <title>searx.botdetection.http_sec_fetch &#8212; SearXNG Documentation (2025.5.11+d16854e67)</title>
    9. 

  9.     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=6625fa76" />
    10. 

  10.     <link rel="stylesheet" type="text/css" href="../../../_static/searxng.css?v=52e4ff28" />
    11. 

  11.     <script src="../../../_static/documentation_options.js?v=899544a3"></script>
    12. 

  12.     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
    13. 

  13.     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
    14. 

  14.     <script data-project="searxng" data-version="2025.5.11+d16854e67" src="../../../_static/describe_version.js?v=fa7f30d0"></script>
    15. 

  15.     <link rel="index" title="Index" href="../../../genindex.html" />
    16. 

  16.     <link rel="search" title="Search" href="../../../search.html" /> 
    17. 

  17.   </head><body>
    18. 

  18.     <div class="related" role="navigation" aria-label="Related">
    19. 

  19.       <h3>Navigation</h3>
    20. 

  20.       <ul>
    21. 

  21.         <li class="right" style="margin-right: 10px">
    22. 

  22.           <a href="../../../genindex.html" title="General Index"
    23. 

  23.              accesskey="I">index</a></li>
    24. 

  24.         <li class="right" >
    25. 

  25.           <a href="../../../py-modindex.html" title="Python Module Index"
    26. 

  26.              >modules</a> |</li>
    27. 

  27.         <li class="nav-item nav-item-0"><a href="../../../index.html">SearXNG Documentation (2025.5.11+d16854e67)</a> &#187;</li>
    28. 

  28.           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
    29. 

  29.         <li class="nav-item nav-item-this"><a href="">searx.botdetection.http_sec_fetch</a></li> 
    30. 

  30.       </ul>
    31. 

  31.     </div>  
    32. 

  32. 

  33.     <div class="document">
    34. 

  34.       <div class="documentwrapper">
    35. 

  35.         <div class="bodywrapper">
    36. 

  36.           <div class="body" role="main">
    37. 

  37.             
    38. 

  38.   <h1>Source code for searx.botdetection.http_sec_fetch</h1><div class="highlight"><pre>
    39. 

  39. <span></span><span class="c1"># SPDX-License-Identifier: AGPL-3.0-or-later</span>
    40. 

  40. <span class="sd">&quot;&quot;&quot;</span>
    41. 

  41. <span class="sd">Method ``http_sec_fetch``</span>
    42. 

  42. <span class="sd">-------------------------</span>
    43. 

  43. 

  44. <span class="sd">The ``http_sec_fetch`` method protect resources from web attacks with `Fetch</span>
    45. 

  45. <span class="sd">Metadata`_.  A request is filtered out in case of:</span>
    46. 

  46. 

  47. <span class="sd">- http header Sec-Fetch-Mode_ is invalid</span>
    48. 

  48. <span class="sd">- http header Sec-Fetch-Dest_ is invalid</span>
    49. 

  49. 

  50. <span class="sd">.. _Fetch Metadata:</span>
    51. 

  51. <span class="sd">   https://developer.mozilla.org/en-US/docs/Glossary/Fetch_metadata_request_header</span>
    52. 

  52. 

  53. <span class="sd">.. _Sec-Fetch-Dest:</span>
    54. 

  54. <span class="sd">   https://developer.mozilla.org/en-US/docs/Web/API/Request/destination</span>
    55. 

  55. 

  56. <span class="sd">.. _Sec-Fetch-Mode:</span>
    57. 

  57. <span class="sd">   https://developer.mozilla.org/en-US/docs/Web/API/Request/mode</span>
    58. 

  58. 

  59. 

  60. <span class="sd">&quot;&quot;&quot;</span>
    61. 

  61. <span class="c1"># pylint: disable=unused-argument</span>
    62. 

  62. 

  63. <span class="kn">from</span><span class="w"> </span><span class="nn">__future__</span><span class="w"> </span><span class="kn">import</span> <span class="n">annotations</span>
    64. 

  64. <span class="kn">from</span><span class="w"> </span><span class="nn">ipaddress</span><span class="w"> </span><span class="kn">import</span> <span class="p">(</span>
    65. 

  65.     <span class="n">IPv4Network</span><span class="p">,</span>
    66. 

  66.     <span class="n">IPv6Network</span><span class="p">,</span>
    67. 

  67. <span class="p">)</span>
    68. 

  68. 

  69. <span class="kn">import</span><span class="w"> </span><span class="nn">re</span>
    70. 

  70. <span class="kn">import</span><span class="w"> </span><span class="nn">flask</span>
    71. 

  71. <span class="kn">import</span><span class="w"> </span><span class="nn">werkzeug</span>
    72. 

  72. 

  73. <span class="kn">from</span><span class="w"> </span><span class="nn">searx.extended_types</span><span class="w"> </span><span class="kn">import</span> <span class="n">SXNG_Request</span>
    74. 

  74. 

  75. <span class="kn">from</span><span class="w"> </span><span class="nn">.</span><span class="w"> </span><span class="kn">import</span> <span class="n">config</span>
    76. 

  76. <span class="kn">from</span><span class="w"> </span><span class="nn">._helpers</span><span class="w"> </span><span class="kn">import</span> <span class="n">logger</span>
    77. 

  77. 

  78. 

  79. <div class="viewcode-block" id="is_browser_supported">
    80. 

  80. <a class="viewcode-back" href="../../../src/searx.botdetection.html#searx.botdetection.http_sec_fetch.is_browser_supported">[docs]</a>
    81. 

  81. <span class="k">def</span><span class="w"> </span><span class="nf">is_browser_supported</span><span class="p">(</span><span class="n">user_agent</span><span class="p">:</span> <span class="nb">str</span><span class="p">)</span> <span class="o">-&gt;</span> <span class="nb">bool</span><span class="p">:</span>
    82. 

  82. <span class="w">    </span><span class="sd">&quot;&quot;&quot;Check if the browser supports Sec-Fetch headers.</span>
    83. 

  83. 

  84. <span class="sd">    https://caniuse.com/mdn-http_headers_sec-fetch-dest</span>
    85. 

  85. <span class="sd">    https://caniuse.com/mdn-http_headers_sec-fetch-mode</span>
    86. 

  86. <span class="sd">    https://caniuse.com/mdn-http_headers_sec-fetch-site</span>
    87. 

  87. 

  88. <span class="sd">    Supported browsers:</span>
    89. 

  89. <span class="sd">    - Chrome &gt;= 80</span>
    90. 

  90. <span class="sd">    - Firefox &gt;= 90</span>
    91. 

  91. <span class="sd">    - Safari &gt;= 16.4</span>
    92. 

  92. <span class="sd">    - Edge (mirrors Chrome)</span>
    93. 

  93. <span class="sd">    - Opera (mirrors Chrome)</span>
    94. 

  94. <span class="sd">    &quot;&quot;&quot;</span>
    95. 

  95.     <span class="n">user_agent</span> <span class="o">=</span> <span class="n">user_agent</span><span class="o">.</span><span class="n">lower</span><span class="p">()</span>
    96. 

  96. 

  97.     <span class="c1"># Chrome/Chromium/Edge/Opera</span>
    98. 

  98.     <span class="n">chrome_match</span> <span class="o">=</span> <span class="n">re</span><span class="o">.</span><span class="n">search</span><span class="p">(</span><span class="sa">r</span><span class="s1">&#39;chrome/(\d+)&#39;</span><span class="p">,</span> <span class="n">user_agent</span><span class="p">)</span>
    99. 

  99.     <span class="k">if</span> <span class="n">chrome_match</span><span class="p">:</span>
    100. 

  100.         <span class="n">version</span> <span class="o">=</span> <span class="nb">int</span><span class="p">(</span><span class="n">chrome_match</span><span class="o">.</span><span class="n">group</span><span class="p">(</span><span class="mi">1</span><span class="p">))</span>
    101. 

  101.         <span class="k">return</span> <span class="n">version</span> <span class="o">&gt;=</span> <span class="mi">80</span>
    102. 

  102. 

  103.     <span class="c1"># Firefox</span>
    104. 

  104.     <span class="n">firefox_match</span> <span class="o">=</span> <span class="n">re</span><span class="o">.</span><span class="n">search</span><span class="p">(</span><span class="sa">r</span><span class="s1">&#39;firefox/(\d+)&#39;</span><span class="p">,</span> <span class="n">user_agent</span><span class="p">)</span>
    105. 

  105.     <span class="k">if</span> <span class="n">firefox_match</span><span class="p">:</span>
    106. 

  106.         <span class="n">version</span> <span class="o">=</span> <span class="nb">int</span><span class="p">(</span><span class="n">firefox_match</span><span class="o">.</span><span class="n">group</span><span class="p">(</span><span class="mi">1</span><span class="p">))</span>
    107. 

  107.         <span class="k">return</span> <span class="n">version</span> <span class="o">&gt;=</span> <span class="mi">90</span>
    108. 

  108. 

  109.     <span class="c1"># Safari</span>
    110. 

  110.     <span class="n">safari_match</span> <span class="o">=</span> <span class="n">re</span><span class="o">.</span><span class="n">search</span><span class="p">(</span><span class="sa">r</span><span class="s1">&#39;version/(\d+)\.(\d+)&#39;</span><span class="p">,</span> <span class="n">user_agent</span><span class="p">)</span>
    111. 

  111.     <span class="k">if</span> <span class="n">safari_match</span><span class="p">:</span>
    112. 

  112.         <span class="n">major</span> <span class="o">=</span> <span class="nb">int</span><span class="p">(</span><span class="n">safari_match</span><span class="o">.</span><span class="n">group</span><span class="p">(</span><span class="mi">1</span><span class="p">))</span>
    113. 

  113.         <span class="n">minor</span> <span class="o">=</span> <span class="nb">int</span><span class="p">(</span><span class="n">safari_match</span><span class="o">.</span><span class="n">group</span><span class="p">(</span><span class="mi">2</span><span class="p">))</span>
    114. 

  114.         <span class="k">return</span> <span class="n">major</span> <span class="o">&gt;</span> <span class="mi">16</span> <span class="ow">or</span> <span class="p">(</span><span class="n">major</span> <span class="o">==</span> <span class="mi">16</span> <span class="ow">and</span> <span class="n">minor</span> <span class="o">&gt;=</span> <span class="mi">4</span><span class="p">)</span>
    115. 

  115. 

  116.     <span class="k">return</span> <span class="kc">False</span></div>
    117. 

  117. 

  118. 

  119. 

  120. <span class="k">def</span><span class="w"> </span><span class="nf">filter_request</span><span class="p">(</span>
    121. 

  121.     <span class="n">network</span><span class="p">:</span> <span class="n">IPv4Network</span> <span class="o">|</span> <span class="n">IPv6Network</span><span class="p">,</span>
    122. 

  122.     <span class="n">request</span><span class="p">:</span> <span class="n">SXNG_Request</span><span class="p">,</span>
    123. 

  123.     <span class="n">cfg</span><span class="p">:</span> <span class="n">config</span><span class="o">.</span><span class="n">Config</span><span class="p">,</span>
    124. 

  124. <span class="p">)</span> <span class="o">-&gt;</span> <span class="n">werkzeug</span><span class="o">.</span><span class="n">Response</span> <span class="o">|</span> <span class="kc">None</span><span class="p">:</span>
    125. 

  125. 

  126.     <span class="c1"># Only check Sec-Fetch headers for supported browsers</span>
    127. 

  127.     <span class="n">user_agent</span> <span class="o">=</span> <span class="n">request</span><span class="o">.</span><span class="n">headers</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s1">&#39;User-Agent&#39;</span><span class="p">,</span> <span class="s1">&#39;&#39;</span><span class="p">)</span>
    128. 

  128.     <span class="k">if</span> <span class="n">is_browser_supported</span><span class="p">(</span><span class="n">user_agent</span><span class="p">):</span>
    129. 

  129.         <span class="n">val</span> <span class="o">=</span> <span class="n">request</span><span class="o">.</span><span class="n">headers</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s2">&quot;Sec-Fetch-Mode&quot;</span><span class="p">,</span> <span class="s2">&quot;&quot;</span><span class="p">)</span>
    130. 

  130.         <span class="k">if</span> <span class="n">val</span> <span class="ow">not</span> <span class="ow">in</span> <span class="p">(</span><span class="s1">&#39;navigate&#39;</span><span class="p">,</span> <span class="s1">&#39;cors&#39;</span><span class="p">):</span>
    131. 

  131.             <span class="n">logger</span><span class="o">.</span><span class="n">debug</span><span class="p">(</span><span class="s2">&quot;invalid Sec-Fetch-Mode &#39;</span><span class="si">%s</span><span class="s2">&#39;&quot;</span><span class="p">,</span> <span class="n">val</span><span class="p">)</span>
    132. 

  132.             <span class="k">return</span> <span class="n">flask</span><span class="o">.</span><span class="n">redirect</span><span class="p">(</span><span class="n">flask</span><span class="o">.</span><span class="n">url_for</span><span class="p">(</span><span class="s1">&#39;index&#39;</span><span class="p">),</span> <span class="n">code</span><span class="o">=</span><span class="mi">302</span><span class="p">)</span>
    133. 

  133. 

  134.         <span class="n">val</span> <span class="o">=</span> <span class="n">request</span><span class="o">.</span><span class="n">headers</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s2">&quot;Sec-Fetch-Site&quot;</span><span class="p">,</span> <span class="s2">&quot;&quot;</span><span class="p">)</span>
    135. 

  135.         <span class="k">if</span> <span class="n">val</span> <span class="ow">not</span> <span class="ow">in</span> <span class="p">(</span><span class="s1">&#39;same-origin&#39;</span><span class="p">,</span> <span class="s1">&#39;same-site&#39;</span><span class="p">,</span> <span class="s1">&#39;none&#39;</span><span class="p">):</span>
    136. 

  136.             <span class="n">logger</span><span class="o">.</span><span class="n">debug</span><span class="p">(</span><span class="s2">&quot;invalid Sec-Fetch-Site &#39;</span><span class="si">%s</span><span class="s2">&#39;&quot;</span><span class="p">,</span> <span class="n">val</span><span class="p">)</span>
    137. 

  137.             <span class="n">flask</span><span class="o">.</span><span class="n">redirect</span><span class="p">(</span><span class="n">flask</span><span class="o">.</span><span class="n">url_for</span><span class="p">(</span><span class="s1">&#39;index&#39;</span><span class="p">),</span> <span class="n">code</span><span class="o">=</span><span class="mi">302</span><span class="p">)</span>
    138. 

  138. 

  139.         <span class="n">val</span> <span class="o">=</span> <span class="n">request</span><span class="o">.</span><span class="n">headers</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s2">&quot;Sec-Fetch-Dest&quot;</span><span class="p">,</span> <span class="s2">&quot;&quot;</span><span class="p">)</span>
    140. 

  140.         <span class="k">if</span> <span class="n">val</span> <span class="ow">not</span> <span class="ow">in</span> <span class="p">(</span><span class="s1">&#39;document&#39;</span><span class="p">,</span> <span class="s1">&#39;empty&#39;</span><span class="p">):</span>
    141. 

  141.             <span class="n">logger</span><span class="o">.</span><span class="n">debug</span><span class="p">(</span><span class="s2">&quot;invalid Sec-Fetch-Dest &#39;</span><span class="si">%s</span><span class="s2">&#39;&quot;</span><span class="p">,</span> <span class="n">val</span><span class="p">)</span>
    142. 

  142.             <span class="n">flask</span><span class="o">.</span><span class="n">redirect</span><span class="p">(</span><span class="n">flask</span><span class="o">.</span><span class="n">url_for</span><span class="p">(</span><span class="s1">&#39;index&#39;</span><span class="p">),</span> <span class="n">code</span><span class="o">=</span><span class="mi">302</span><span class="p">)</span>
    143. 

  143. 

  144.     <span class="k">return</span> <span class="kc">None</span>
    145. 

  145. </pre></div>
    146. 

  146. 

  147.             <div class="clearer"></div>
    148. 

  148.           </div>
    149. 

  149.         </div>
    150. 

  150.       </div>
    151. 

  151.   <span id="sidebar-top"></span>
    152. 

  152.       <div class="sphinxsidebar" role="navigation" aria-label="Main">
    153. 

  153.         <div class="sphinxsidebarwrapper">
    154. 

  154.   
    155. 

  155.     
    156. 

  156.             <p class="logo"><a href="../../../index.html">
    157. 

  157.               <img class="logo" src="../../../_static/searxng-wordmark.svg" alt="Logo of SearXNG"/>
    158. 

  158.             </a></p>
    159. 

  159.   
    160. 

  160. 

  161. <h3><a href="../../../index.html">Table of Contents</a></h3>
    162. 

  162. <ul>
    163. 

  163. <li class="toctree-l1"><a class="reference internal" href="../../../user/index.html">User information</a></li>
    164. 

  164. <li class="toctree-l1"><a class="reference internal" href="../../../own-instance.html">Why use a private instance?</a></li>
    165. 

  165. <li class="toctree-l1"><a class="reference internal" href="../../../admin/index.html">Administrator documentation</a></li>
    166. 

  166. <li class="toctree-l1"><a class="reference internal" href="../../../dev/index.html">Developer documentation</a></li>
    167. 

  167. <li class="toctree-l1"><a class="reference internal" href="../../../utils/index.html">DevOps tooling box</a></li>
    168. 

  168. <li class="toctree-l1"><a class="reference internal" href="../../../src/index.html">Source-Code</a></li>
    169. 

  169. </ul>
    170. 

  170. 

  171.   <h3>Project Links</h3>
    172. 

  172.   <ul>
    173. 

  173.     <li><a href="https://github.com/searxng/searxng/tree/master">Source</a>
    174. 

  174.   
    175. 

  175.     <li><a href="https://github.com/searxng/searxng/wiki">Wiki</a>
    176. 

  176.   
    177. 

  177.     <li><a href="https://searx.space">Public instances</a>
    178. 

  178.   
    179. 

  179.     <li><a href="https://github.com/searxng/searxng/issues">Issue Tracker</a>
    180. 

  180.   </ul><h3>Navigation</h3>
    181. 

  181. <ul>
    182. 

  182.   <li><a href="../../../index.html">Overview</a>
    183. 

  183.     <ul>
    184. 

  184.       <li><a href="../../index.html">Module code</a>
    185. 

  185.         
    186. 

  186.           
    187. 

  187.           </ul>
    188. 

  188.       </li>
    189. 

  189.     </ul>
    190. 

  190.   </li>
    191. 

  191. </ul>
    192. 

  192. <search id="searchbox" style="display: none" role="search">
    193. 

  193.   <h3 id="searchlabel">Quick search</h3>
    194. 

  194.     <div class="searchformwrapper">
    195. 

  195.     <form class="search" action="../../../search.html" method="get">
    196. 

  196.       <input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
    197. 

  197.       <input type="submit" value="Go" />
    198. 

  198.     </form>
    199. 

  199.     </div>
    200. 

  200. </search>
    201. 

  201. <script>document.getElementById('searchbox').style.display = "block"</script>
    202. 

  202.         </div>
    203. 

  203.       </div>
    204. 

  204.       <div class="clearer"></div>
    205. 

  205.     </div>
    206. 

  206.     <div class="footer" role="contentinfo">
    207. 

  207.     &#169; Copyright SearXNG team.
    208. 

  208.     </div>
    209. 

  209.   </body>
    210. 

  210. </html>
    211.
© 2025 NTab仓库
Page: 54ms Template: 0ms 微信 微信二维码 哔哩哔哩 Sina Weibo Javascript Licenses Website