CSRF와 기타 웹 취약점

# ⚠️ 교육 목적, 허가된 환경에서만 사용.
from flask import Flask, session, request, abort
from secrets import token_urlsafe
from functools import wraps

app = Flask(__name__)
app.secret_key = token_urlsafe(32)


def csrf_protect(f):
    @wraps(f)
    def wrapper(*args, **kwargs):
        if request.method == 'POST':
            token = request.form.get('csrf_token') or request.headers.get('X-CSRF-Token')
            session_token = session.get('csrf_token')
            if not token or token != session_token:
                abort(403, 'CSRF token mismatch')
        if 'csrf_token' not in session:
            session['csrf_token'] = token_urlsafe(32)
        return f(*args, **kwargs)
    return wrapper


@app.route('/transfer', methods=['POST'])
@csrf_protect
def transfer():
    amount = request.form['amount']
    # 안전: CSRF 토큰 검증 통과
    return 'OK'


# ✅ 추가 방어: SameSite=Strict 쿠키
@app.after_request
def set_secure_cookies(response):
    response.headers.add(
        'Set-Cookie',
        f'session={session.sid}; HttpOnly; Secure; SameSite=Strict; Path=/',
    )
    return response

import requests
import ipaddress
from urllib.parse import urlparse


PRIVATE_NETWORKS = [
    ipaddress.ip_network('10.0.0.0/8'),
    ipaddress.ip_network('172.16.0.0/12'),
    ipaddress.ip_network('192.168.0.0/16'),
    ipaddress.ip_network('127.0.0.0/8'),
    ipaddress.ip_network('169.254.0.0/16'),  # AWS metadata
]

ALLOWED_DOMAINS = {'api.partner.com', 'cdn.example.com'}


def is_safe_url(url: str) -> bool:
    parsed = urlparse(url)

    # 1. 스키마 검증
    if parsed.scheme not in ('http', 'https'):
        return False

    # 2. 도메인 화이트리스트
    if parsed.hostname not in ALLOWED_DOMAINS:
        return False

    # 3. DNS 해석 후 사설 IP 차단 (DNS rebinding 방어)
    import socket
    try:
        ip_str = socket.gethostbyname(parsed.hostname)
        ip = ipaddress.ip_address(ip_str)
        for net in PRIVATE_NETWORKS:
            if ip in net:
                return False
    except (socket.gaierror, ValueError):
        return False

    return True


def fetch_external(url: str) -> bytes:
    if not is_safe_url(url):
        raise ValueError(f'Unsafe URL: {url}')
    return requests.get(url, timeout=5, allow_redirects=False).content

from pathlib import Path

UPLOAD_DIR = Path('/var/app/uploads').resolve()


def safe_file_read(filename: str) -> bytes:
    # ❌ 위험: '../../../etc/passwd' 우회 가능
    # path = UPLOAD_DIR / filename

    # ✅ 안전: resolve() + 부모 디렉터리 검증
    target = (UPLOAD_DIR / filename).resolve()
    if UPLOAD_DIR not in target.parents and target != UPLOAD_DIR:
        raise ValueError(f'Path traversal attempt: {filename}')
    if not target.is_file():
        raise FileNotFoundError(filename)
    return target.read_bytes()

import magic  # python-magic
from pathlib import Path
from secrets import token_hex

ALLOWED_MIME = {'image/jpeg', 'image/png', 'image/webp'}
MAX_SIZE = 5 * 1024 * 1024  # 5MB
UPLOAD_DIR = Path('/var/app/uploads').resolve()


def safe_upload(file_storage) -> str:
    # 1. 크기 검증
    file_storage.seek(0, 2)
    size = file_storage.tell()
    file_storage.seek(0)
    if size > MAX_SIZE:
        raise ValueError('File too large')

    # 2. MIME 검증 (magic byte — 확장자 위조 방지)
    mime = magic.from_buffer(file_storage.read(2048), mime=True)
    file_storage.seek(0)
    if mime not in ALLOWED_MIME:
        raise ValueError(f'MIME not allowed: {mime}')

    # 3. 랜덤 파일명 (원본 이름 사용 금지)
    ext = {'image/jpeg': '.jpg', 'image/png': '.png', 'image/webp': '.webp'}[mime]
    new_name = f'{token_hex(16)}{ext}'
    target = UPLOAD_DIR / new_name

    # 4. 실행 권한 차단 (파일 시스템 레벨 — chmod 644)
    file_storage.save(target)
    target.chmod(0o644)

    return new_name