mirror of
https://github.com/ziirish/burp-ui.git
synced 2026-05-15 06:05:58 -06:00
87 lines
2.8 KiB
Python
87 lines
2.8 KiB
Python
# -*- coding: utf8 -*-
|
|
"""
|
|
.. module:: burpui.security
|
|
:platform: Unix
|
|
:synopsis: Burp-UI security module.
|
|
|
|
.. moduleauthor:: Ziirish <hi+burpui@ziirish.me>
|
|
|
|
"""
|
|
from ._compat import to_unicode, urljoin, urlparse
|
|
|
|
|
|
def sanitize_string(string, strict=True, paranoid=False):
|
|
"""Return a 'safe' version of the string (ie. remove malicious chars like
|
|
'\n')
|
|
|
|
:param string: String to escape
|
|
:type string: str
|
|
"""
|
|
if not string:
|
|
return ""
|
|
if paranoid:
|
|
return to_unicode(string.encode("unicode_escape"))
|
|
elif strict:
|
|
return to_unicode(string).split("\n")[0]
|
|
else:
|
|
import re
|
|
|
|
ret = repr(string).replace("\\\\", "\\")
|
|
ret = re.sub(r"^u?(?P<quote>['\"])(.*)(?P=quote)$", r"\2", ret)
|
|
return to_unicode(ret)
|
|
|
|
|
|
def basic_login_from_request(request, app):
|
|
"""Check 'Authorization' headers and log the user in if possible.
|
|
|
|
:param request: The input request
|
|
:type request: :class:`flask.Request`
|
|
|
|
:param app: The application context
|
|
:type app: :class:`burpui.engines.server.BUIServer`
|
|
"""
|
|
if app.auth != "none":
|
|
if request.headers.get("X-From-UI", False):
|
|
return None
|
|
auth = request.authorization
|
|
if auth:
|
|
from flask import g, session
|
|
|
|
app.logger.debug("Found Basic user: {}".format(auth.username))
|
|
refresh = True
|
|
if "login" in session and session["login"] == auth.username:
|
|
refresh = False
|
|
session["language"] = request.headers.get("X-Language", "en")
|
|
user = app.uhandler.user(auth.username, refresh)
|
|
if user and user.active and user.login(auth.password):
|
|
from flask_login import login_user
|
|
|
|
from .sessions import session_manager
|
|
|
|
if "login" in session and session["login"] != auth.username:
|
|
session.clear()
|
|
session["login"] = auth.username
|
|
session["language"] = request.headers.get("X-Language", "en")
|
|
login_user(user)
|
|
if request.headers.get("X-Reuse-Session", False):
|
|
session_manager.store_session(
|
|
auth.username,
|
|
request.remote_addr,
|
|
request.headers.get("User-Agent"),
|
|
remember=False,
|
|
api=True,
|
|
)
|
|
else:
|
|
g.basic_session = True
|
|
app.logger.debug("Successfully logged in")
|
|
return user
|
|
app.logger.warning("Failed to log-in")
|
|
return None
|
|
|
|
|
|
def is_safe_url(target):
|
|
from flask import request
|
|
|
|
ref_url = urlparse(request.host_url)
|
|
test_url = urlparse(urljoin(request.host_url, target))
|
|
return test_url.scheme in ("http", "https") and ref_url.netloc == test_url.netloc
|