mirror of
https://github.com/searxng/searxng
synced 2024-01-01 19:24:07 +01:00
1c9b28968d
HTTP Fetch Metadata Request Headers [1][2] are used to detect bot requests. Bots with invalid *Fetch Metadata* will be redirected to the intro (`index`) page. [1] https://www.w3.org/TR/fetch-metadata/ [2] https://developer.mozilla.org/en-US/docs/Glossary/Fetch_metadata_request_header Signed-off-by: Markus Heiser <markus.heiser@darmarit.de>
59 lines
1.6 KiB
Python
59 lines
1.6 KiB
Python
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
"""
|
|
Method ``http_sec_fetch``
|
|
-------------------------
|
|
|
|
The ``http_sec_fetch`` method protect resources from web attacks with `Fetch
|
|
Metadata`_. A request is filtered out in case of:
|
|
|
|
- http header Sec-Fetch-Mode_ is invalid
|
|
- http header Sec-Fetch-Dest_ is invalid
|
|
|
|
.. _Fetch Metadata:
|
|
https://developer.mozilla.org/en-US/docs/Glossary/Fetch_metadata_request_header
|
|
|
|
.. Sec-Fetch-Dest:
|
|
https://developer.mozilla.org/en-US/docs/Web/API/Request/destination
|
|
|
|
.. Sec-Fetch-Mode:
|
|
https://developer.mozilla.org/en-US/docs/Web/API/Request/mode
|
|
|
|
|
|
"""
|
|
# pylint: disable=unused-argument
|
|
|
|
from __future__ import annotations
|
|
from ipaddress import (
|
|
IPv4Network,
|
|
IPv6Network,
|
|
)
|
|
|
|
import flask
|
|
import werkzeug
|
|
|
|
from . import config
|
|
from ._helpers import logger
|
|
|
|
|
|
def filter_request(
|
|
network: IPv4Network | IPv6Network,
|
|
request: flask.Request,
|
|
cfg: config.Config,
|
|
) -> werkzeug.Response | None:
|
|
|
|
val = request.headers.get("Sec-Fetch-Mode", "")
|
|
if val != "navigate":
|
|
logger.debug("invalid Sec-Fetch-Mode '%s'", val)
|
|
return flask.redirect(flask.url_for('index'), code=302)
|
|
|
|
val = request.headers.get("Sec-Fetch-Site", "")
|
|
if val not in ('same-origin', 'same-site', 'none'):
|
|
logger.debug("invalid Sec-Fetch-Site '%s'", val)
|
|
flask.redirect(flask.url_for('index'), code=302)
|
|
|
|
val = request.headers.get("Sec-Fetch-Dest", "")
|
|
if val != "document":
|
|
logger.debug("invalid Sec-Fetch-Dest '%s'", val)
|
|
flask.redirect(flask.url_for('index'), code=302)
|
|
|
|
return None
|