SSRF、密钥与 PII 保护

New-Item -ItemType Directory -Force l8-ssrf
Set-Location l8-ssrf

mkdir -p l8-ssrf
cd l8-ssrf

"""用固定地址表做 URL 策略判断，不发起网络请求。"""
import ipaddress
from urllib.parse import urlsplit

# 地址表模拟解析结果，包含同一域名返回多个地址的情况。
DNS = {"docs.example.test": ["93.184.216.34"],
       "mixed.example.test": ["93.184.216.34", "127.0.0.1"]}
HOSTS = {"docs.example.test", "mixed.example.test"}
TARGET = "https://docs.example.test/guide"

def check_url(url, dns):
    try:
        parsed = urlsplit(url)
        port = parsed.port
    except ValueError:
        return "拒绝：URL格式"
    if parsed.scheme != "https":
        return "拒绝：协议"
    if parsed.username is not None or parsed.password is not None:
        return "拒绝：URL含凭据"
    if parsed.hostname not in HOSTS or port not in (None, 443):
        return "拒绝：域名或端口"
    addresses = dns.get(parsed.hostname, [])
    if not addresses:
        return "拒绝：无解析地址"
    try:
        # 一个解析地址违规就拒绝，不能只挑第一个公网地址。
        if any(not ipaddress.ip_address(ip).is_global for ip in addresses):
            return "拒绝：非公网地址"
    except ValueError:
        return "拒绝：地址格式"
    return "允许：地址策略通过"

def safe_fields(record):
    # 按字段白名单输出，测试邮箱与测试令牌都留在输入侧。
    return {key: record[key] for key in ("title",) if key in record}

def main():
    print("资料地址 ->", check_url(TARGET, DNS))
    print("混合解析 ->", check_url("https://mixed.example.test/guide", DNS))
    print("最少字段 ->", safe_fields(
        {"title": "接口文档", "email": "reader@example.test", "token": "FAKE_TOKEN"}))

if __name__ == "__main__":
    main()

import unittest
# 固定良性输入检查正常、拒绝和边界路径，不连接外部服务。
from ssrf_demo import DNS, check_url, safe_fields

class AddressTests(unittest.TestCase):
    def test_normal(self):
        self.assertTrue(check_url("https://docs.example.test/guide", DNS).startswith("允许"))

    def test_mixed_addresses(self):
        self.assertEqual(check_url("https://mixed.example.test/", DNS), "拒绝：非公网地址")

    def test_scheme(self):
        self.assertEqual(check_url("file:///guide", DNS), "拒绝：协议")

    def test_credentials(self):
        self.assertEqual(check_url("https://u:p@docs.example.test/", DNS), "拒绝：URL含凭据")

    def test_host_and_port(self):
        for url in ("https://other.example.test/", "https://docs.example.test:8443/"):
            self.assertEqual(check_url(url, DNS), "拒绝：域名或端口")

    def test_dns_boundary(self):
        for addresses in ([], ["::1"], ["bad-ip"]):
            self.assertTrue(check_url("https://docs.example.test/",
                                     {"docs.example.test": addresses}).startswith("拒绝"))

    def test_field_projection(self):
        self.assertEqual(safe_fields({"title": "指南", "token": "FAKE", "email": "a@test"}),
                         {"title": "指南"})

if __name__ == "__main__":
    unittest.main()

ls
python -X utf8 ssrf_demo.py

资料地址 -> 允许：地址策略通过
混合解析 -> 拒绝：非公网地址
最少字段 -> {'title': '接口文档'}

python -X utf8 -m unittest -v test_ssrf.py

python -X utf8 ssrf_demo.py