48 lines
1.2 KiB
Python
48 lines
1.2 KiB
Python
import re
|
|
from flask import Flask, request, make_response
|
|
from markupsafe import escape
|
|
|
|
app = Flask(__name__)
|
|
|
|
# Limiter la taille maximale des requêtes pour éviter le DoS
|
|
app.config['MAX_CONTENT_LENGTH'] = 1 * 1024 * 1024 # 1 Mo
|
|
|
|
|
|
def add_security_headers(response):
|
|
response.headers['X-Content-Type-Options'] = 'nosniff'
|
|
response.headers['X-Frame-Options'] = 'DENY'
|
|
response.headers['Content-Type'] = 'text/html; charset=utf-8'
|
|
return response
|
|
|
|
|
|
@app.after_request
|
|
def after_request(response):
|
|
return add_security_headers(response)
|
|
|
|
|
|
@app.route('/hello', methods=['GET'])
|
|
def hello():
|
|
name = request.args.get('name', '')
|
|
|
|
if not name:
|
|
resp = make_response("Hello Guest", 200)
|
|
return resp
|
|
|
|
# 1. Longueur max pour éviter les attaques par déni de service
|
|
if len(name) > 100:
|
|
return "Erreur : Le nom est trop long", 400
|
|
|
|
# 2. Validation stricte : uniquement alphanumérique
|
|
if not re.match(r'^[a-zA-Z0-9]+$', name):
|
|
return "Erreur : Le nom contient des caractères interdits", 400
|
|
|
|
# 3. Échappement XSS
|
|
safe_name = escape(name)
|
|
|
|
resp = make_response(f"Hello {safe_name}", 200)
|
|
return resp
|
|
|
|
|
|
if __name__ == '__main__':
|
|
app.run(debug=False)
|