110 lines
2.6 KiB
Python
110 lines
2.6 KiB
Python
"""
|
||
FastAPI 框架安全知识
|
||
"""
|
||
|
||
from ..base import KnowledgeDocument, KnowledgeCategory
|
||
|
||
|
||
FASTAPI_SECURITY = KnowledgeDocument(
|
||
id="framework_fastapi",
|
||
title="FastAPI Security",
|
||
category=KnowledgeCategory.FRAMEWORK,
|
||
tags=["fastapi", "python", "api", "async", "pydantic"],
|
||
content="""
|
||
FastAPI 是一个现代Python Web框架，内置了许多安全特性，但仍需注意一些常见问题。
|
||
|
||
## 安全特性
|
||
1. Pydantic自动数据验证
|
||
2. 自动生成OpenAPI文档
|
||
3. 内置OAuth2/JWT支持
|
||
4. 依赖注入系统
|
||
|
||
## 常见漏洞模式
|
||
|
||
### SQL注入
|
||
```python
|
||
# 危险 - 原始SQL
|
||
@app.get("/users")
|
||
async def get_users(name: str):
|
||
query = f"SELECT * FROM users WHERE name = '{name}'"
|
||
return await database.fetch_all(query)
|
||
|
||
# 安全 - 参数化查询
|
||
@app.get("/users")
|
||
async def get_users(name: str):
|
||
query = "SELECT * FROM users WHERE name = :name"
|
||
return await database.fetch_all(query, {"name": name})
|
||
```
|
||
|
||
### IDOR
|
||
```python
|
||
# 危险 - 无权限检查
|
||
@app.get("/users/{user_id}")
|
||
async def get_user(user_id: int):
|
||
return await User.get(user_id)
|
||
|
||
# 安全 - 验证权限
|
||
@app.get("/users/{user_id}")
|
||
async def get_user(user_id: int, current_user: User = Depends(get_current_user)):
|
||
if user_id != current_user.id and not current_user.is_admin:
|
||
raise HTTPException(status_code=403)
|
||
return await User.get(user_id)
|
||
```
|
||
|
||
### 路径遍历
|
||
```python
|
||
# 危险
|
||
@app.get("/files/{filename}")
|
||
async def get_file(filename: str):
|
||
return FileResponse(f"/uploads/{filename}")
|
||
|
||
# 安全 - 验证路径
|
||
@app.get("/files/{filename}")
|
||
async def get_file(filename: str):
|
||
safe_path = Path("/uploads").resolve() / filename
|
||
if not str(safe_path.resolve()).startswith(str(Path("/uploads").resolve())):
|
||
raise HTTPException(status_code=400)
|
||
return FileResponse(safe_path)
|
||
```
|
||
|
||
### JWT配置问题
|
||
```python
|
||
# 危险 - 弱密钥
|
||
SECRET_KEY = "secret"
|
||
|
||
# 危险 - 不验证签名
|
||
jwt.decode(token, options={"verify_signature": False})
|
||
|
||
# 安全
|
||
SECRET_KEY = os.environ.get("JWT_SECRET_KEY")
|
||
jwt.decode(token, SECRET_KEY, algorithms=["HS256"])
|
||
```
|
||
|
||
### CORS配置
|
||
```python
|
||
# 危险 - 允许所有来源
|
||
app.add_middleware(
|
||
CORSMiddleware,
|
||
allow_origins=["*"],
|
||
allow_credentials=True, # 危险组合！
|
||
)
|
||
|
||
# 安全 - 指定来源
|
||
app.add_middleware(
|
||
CORSMiddleware,
|
||
allow_origins=["https://example.com"],
|
||
allow_credentials=True,
|
||
)
|
||
```
|
||
|
||
## 安全检查清单
|
||
1. 所有端点是否有适当的认证
|
||
2. 是否使用Depends进行权限检查
|
||
3. 文件操作是否验证路径
|
||
4. SQL查询是否参数化
|
||
5. CORS配置是否合理
|
||
6. JWT密钥是否安全存储
|
||
7. 敏感数据是否在响应中暴露
|
||
""",
|
||
)
|