118 lines
2.6 KiB
Python
118 lines
2.6 KiB
Python
"""
|
||
Django 框架安全知识
|
||
"""
|
||
|
||
from ..base import KnowledgeDocument, KnowledgeCategory
|
||
|
||
|
||
DJANGO_SECURITY = KnowledgeDocument(
|
||
id="framework_django",
|
||
title="Django Security",
|
||
category=KnowledgeCategory.FRAMEWORK,
|
||
tags=["django", "python", "web", "orm"],
|
||
content="""
|
||
Django 内置了许多安全保护，但不当使用仍可能引入漏洞。
|
||
|
||
## 内置安全特性
|
||
1. CSRF保护
|
||
2. XSS防护（模板自动转义）
|
||
3. SQL注入防护（ORM）
|
||
4. 点击劫持防护
|
||
5. 安全的密码哈希
|
||
|
||
## 常见漏洞模式
|
||
|
||
### SQL注入
|
||
```python
|
||
# 危险 - raw()和extra()
|
||
User.objects.raw(f"SELECT * FROM users WHERE name = '{name}'")
|
||
User.objects.extra(where=[f"name = '{name}'"])
|
||
|
||
# 危险 - RawSQL
|
||
from django.db.models.expressions import RawSQL
|
||
User.objects.annotate(val=RawSQL(f"SELECT {user_input}"))
|
||
|
||
# 安全 - 使用ORM
|
||
User.objects.filter(name=name)
|
||
User.objects.raw("SELECT * FROM users WHERE name = %s", [name])
|
||
```
|
||
|
||
### XSS
|
||
```python
|
||
# 危险 - 禁用自动转义
|
||
{{ user_input|safe }}
|
||
{% autoescape off %}{{ user_input }}{% endautoescape %}
|
||
mark_safe(user_input)
|
||
|
||
# 安全 - 默认转义
|
||
{{ user_input }}
|
||
```
|
||
|
||
### CSRF绕过
|
||
```python
|
||
# 危险 - 禁用CSRF
|
||
@csrf_exempt
|
||
def my_view(request):
|
||
pass
|
||
|
||
# 危险 - 全局禁用
|
||
MIDDLEWARE = [
|
||
# 'django.middleware.csrf.CsrfViewMiddleware', # 被注释
|
||
]
|
||
```
|
||
|
||
### 不安全的反序列化
|
||
```python
|
||
# 危险 - 签名数据可被篡改
|
||
from django.core import signing
|
||
data = signing.loads(user_input) # 如果SECRET_KEY泄露
|
||
|
||
# 危险 - pickle
|
||
import pickle
|
||
data = pickle.loads(request.body)
|
||
```
|
||
|
||
### 敏感信息泄露
|
||
```python
|
||
# 危险 - DEBUG模式在生产环境
|
||
DEBUG = True # settings.py
|
||
|
||
# 危险 - 详细错误信息
|
||
ALLOWED_HOSTS = [] # 空列表在DEBUG=False时会报错
|
||
```
|
||
|
||
### 文件上传
|
||
```python
|
||
# 危险 - 不验证文件类型
|
||
def upload(request):
|
||
file = request.FILES['file']
|
||
with open(f'/uploads/{file.name}', 'wb') as f:
|
||
f.write(file.read())
|
||
|
||
# 安全 - 验证和重命名
|
||
import uuid
|
||
def upload(request):
|
||
file = request.FILES['file']
|
||
ext = os.path.splitext(file.name)[1].lower()
|
||
if ext not in ['.jpg', '.png', '.pdf']:
|
||
raise ValidationError("Invalid file type")
|
||
safe_name = f"{uuid.uuid4()}{ext}"
|
||
# 使用Django的文件存储
|
||
default_storage.save(safe_name, file)
|
||
```
|
||
|
||
## 安全配置检查
|
||
```python
|
||
# settings.py 安全配置
|
||
DEBUG = False
|
||
SECRET_KEY = os.environ.get('DJANGO_SECRET_KEY')
|
||
ALLOWED_HOSTS = ['example.com']
|
||
SECURE_SSL_REDIRECT = True
|
||
SESSION_COOKIE_SECURE = True
|
||
CSRF_COOKIE_SECURE = True
|
||
SECURE_HSTS_SECONDS = 31536000
|
||
X_FRAME_OPTIONS = 'DENY'
|
||
```
|
||
""",
|
||
)
|