zhanghongyu_0626
3995cb44d8
- Added `auth.py` for mock login and JWT issuance. - Introduced `chat.py` for handling chat requests with role-based access control. - Enhanced `main.py` to include new routers and middleware for tracing. - Implemented input validation in `input_guard.py` to prevent SQL injection. - Created repositories for managing agent sessions and audit logs. - Added exception handling for authorization errors. - Updated settings to include JWT configuration. - Introduced tests for authentication and input validation.
26 lines
860 B
Python
26 lines
860 B
Python
"""输入防护（F-03 最小实现）。"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import re
|
|
|
|
from app.utils.exceptions import AppError
|
|
|
|
_INJECTION_PATTERNS = (
|
|
re.compile(r"(?i)ignore\s+previous\s+instructions"),
|
|
re.compile(r"(?i)system\s*:\s*"),
|
|
re.compile(r"(?is)(drop|delete|update|insert|alter|truncate)\s+"),
|
|
)
|
|
|
|
|
|
def validate_user_message(message: str, *, max_len: int = 8000) -> str:
|
|
text = message.strip()
|
|
if not text:
|
|
raise AppError(400, "消息不能为空", error_code="INPUT_EMPTY")
|
|
if len(text) > max_len:
|
|
raise AppError(400, "消息过长", error_code="INPUT_OVERSIZE", audit_event="input_guard")
|
|
for pattern in _INJECTION_PATTERNS:
|
|
if pattern.search(text):
|
|
raise AppError(400, "输入包含不允许的内容", error_code="INPUT_BLOCKED", audit_event="input_guard")
|
|
return text
|