a8abed6b5b
- 添加速率限制中间件，防止API滥用和DDoS攻击 - 添加可疑请求检测，基于行为模式识别攻击 - 添加输入清理和验证，防止命令注入和XSS攻击 - 更新middleware.ts，集成所有安全功能 - 添加fail2ban安装脚本，防止SSH暴力破解 - 不依赖IP黑名单，适用于所有攻击者 安全功能： - API速率限制：每分钟100次请求 - 认证速率限制：每分钟5次请求 - 自动检测可疑请求模式 - 输入清理和验证 - 详细的安全日志记录
121 lines
2.8 KiB
TypeScript
121 lines
2.8 KiB
TypeScript
/**
|
||
* 请求监控和安全日志
|
||
* 用于记录可疑请求和异常行为
|
||
*/
|
||
|
||
interface SuspiciousRequest {
|
||
ip: string | null;
|
||
pathname: string;
|
||
method: string;
|
||
userAgent: string | null;
|
||
timestamp: Date;
|
||
reason: string;
|
||
}
|
||
|
||
// 可疑请求关键词
|
||
const SUSPICIOUS_PATTERNS = [
|
||
/wget|curl|nc |netcat|mkfifo|bash -i|sh -i/i,
|
||
/\.update|\.sh|\.py|\.pl|\.rb/i,
|
||
/exec|eval|system|shell|command/i,
|
||
/193\.142\.147\.209|94\.154\.35\.154/i, // 已知攻击者IP
|
||
];
|
||
|
||
// 可疑路径
|
||
const SUSPICIOUS_PATHS = [
|
||
"/.env",
|
||
"/.git/config",
|
||
"/admin",
|
||
"/wp-admin",
|
||
"/phpmyadmin",
|
||
"/.update",
|
||
"/tmp/",
|
||
];
|
||
|
||
/**
|
||
* 检查请求是否可疑
|
||
*/
|
||
export function isSuspiciousRequest(request: Request): {
|
||
suspicious: boolean;
|
||
reason?: string;
|
||
} {
|
||
const url = new URL(request.url);
|
||
const pathname = url.pathname;
|
||
const method = request.method;
|
||
|
||
// 检查可疑路径
|
||
for (const pattern of SUSPICIOUS_PATHS) {
|
||
if (pathname.includes(pattern)) {
|
||
return {
|
||
suspicious: true,
|
||
reason: `Suspicious path: ${pathname}`,
|
||
};
|
||
}
|
||
}
|
||
|
||
// 检查请求体中的可疑内容（仅对POST请求）
|
||
if (method === "POST") {
|
||
// 注意：这里不能直接读取body，因为body只能读取一次
|
||
// 实际检查应该在API路由中进行
|
||
}
|
||
|
||
// 检查User-Agent
|
||
const userAgent = request.headers.get("user-agent") || "";
|
||
for (const pattern of SUSPICIOUS_PATTERNS) {
|
||
if (pattern.test(userAgent)) {
|
||
return {
|
||
suspicious: true,
|
||
reason: `Suspicious User-Agent: ${userAgent.substring(0, 100)}`,
|
||
};
|
||
}
|
||
}
|
||
|
||
return { suspicious: false };
|
||
}
|
||
|
||
/**
|
||
* 记录可疑请求
|
||
*/
|
||
export function logSuspiciousRequest(
|
||
request: Request,
|
||
reason: string
|
||
): void {
|
||
const clientIP = request.headers.get("x-forwarded-for")?.split(",")[0] ||
|
||
request.headers.get("x-real-ip") ||
|
||
"unknown";
|
||
const url = new URL(request.url);
|
||
|
||
const logEntry: SuspiciousRequest = {
|
||
ip: clientIP,
|
||
pathname: url.pathname,
|
||
method: request.method,
|
||
userAgent: request.headers.get("user-agent"),
|
||
timestamp: new Date(),
|
||
reason,
|
||
};
|
||
|
||
console.warn("[Security Alert] Suspicious request detected:", logEntry);
|
||
|
||
// 在生产环境中，这里可以发送到监控系统或日志服务
|
||
// 例如：发送到Sentry、LogRocket、或自定义日志服务
|
||
}
|
||
|
||
/**
|
||
* 验证请求体是否包含可疑内容
|
||
*/
|
||
export async function validateRequestBody(
|
||
body: string
|
||
): Promise<{ valid: boolean; reason?: string }> {
|
||
// 检查是否包含命令执行相关的关键词
|
||
for (const pattern of SUSPICIOUS_PATTERNS) {
|
||
if (pattern.test(body)) {
|
||
return {
|
||
valid: false,
|
||
reason: `Suspicious content detected in request body: ${pattern}`,
|
||
};
|
||
}
|
||
}
|
||
|
||
return { valid: true };
|
||
}
|
||
|