Documentation
¶
Index ¶
- Constants
- Variables
- func CleanMarkdown(input string) string
- func CopyDir(srcDir, dstDir string) error
- func CopyDirectory(srcDir, dstParentDir string) error
- func CopyFile(src, dst string, perm os.FileMode) error
- func DecryptAESGCM(encrypted string, key []byte) (string, error)
- func DecryptStoredSecret(encrypted string) (string, error)
- func EncryptAESGCM(plaintext string, key []byte) (string, error)
- func EscapeHTML(input string) string
- func GenerateID() int64
- func GetAESKey() []byte
- func GetAnalysisDebugDir(baseDir, analysisID, version string) string
- func GetAnalysisDir(baseDir, projectId string, workflow int64) string
- func GetAnalysisNodeDir(baseDir, projectId, scriptID string) string
- func GetCurrentTime() time.Time
- func GetProjectDir(baseDir, projectId string) string
- func GetProjectDocDir(baseDir, projectId string) string
- func GetScriptDir(baseDir, projectId string) string
- func GetScriptFile(baseDir, projectID, scriptType, scriptID string) (string, string, error)
- func GetScriptFileDir(baseDir, projectId, scriptID string) string
- func GetWorkflowDir(baseDir, projectId string) string
- func InitSnowflake(workerID int64) error
- func IsPublicIP(ip net.IP) bool
- func IsSSRFWhitelisted(hostname string) bool
- func IsSystemProxy(host string) bool
- func IsValidImageURL(url string) bool
- func IsValidURL(url string) bool
- func NewSSRFSafeHTTPClient(config SSRFSafeHTTPClientConfig) *http.Client
- func ResolveConfiguredPath(configuredPath string, defaultRelativeToExecutable string) (string, error)
- func ResolveExternalPath(relativePath string) (string, error)
- func ResolveImageDir(baseDir string) string
- func SSRFSafeDialContext(ctx context.Context, network, addr string) (net.Conn, error)
- func SafeFileName(fileName string) (string, error)
- func SafeObjectKey(objectKey string) error
- func SafePathUnderBase(baseDir, filePath string) (string, error)
- func SanitizeForDisplay(input string) string
- func SanitizeForLog(input string) string
- func SanitizeForLogArray(input []string) []string
- func SanitizeHTML(input string) string
- func ValidateInput(input string) (string, bool)
- func ValidateStdioArgs(args []string) error
- func ValidateStdioCommand(command string) error
- func ValidateStdioConfig(command string, args []string, envVars map[string]string) error
- func ValidateStdioEnvVars(envVars map[string]string) error
- func ValidateURLForSSRF(rawURL string) error
- type SSRFSafeHTTPClientConfig
Constants ¶
const EncPrefix = "enc:v1:"
EncPrefix marks a string as AES-256-GCM encrypted
Variables ¶
var AllowedStdioCommands = map[string]bool{ "uvx": true, "npx": true, }
AllowedStdioCommands defines the whitelist of allowed commands for MCP stdio transport These are the standard MCP server launchers that are considered safe
var DangerousArgPatterns = []*regexp.Regexp{ regexp.MustCompile(`(?i)^-c$`), regexp.MustCompile(`(?i)^--command$`), regexp.MustCompile(`(?i)^-e$`), regexp.MustCompile(`(?i)^--eval$`), regexp.MustCompile(`(?i)[;&|]`), regexp.MustCompile(`(?i)\$\(`), regexp.MustCompile("(?i)`"), regexp.MustCompile(`(?i)>\s*[/~]`), regexp.MustCompile(`(?i)<\s*[/~]`), regexp.MustCompile(`(?i)^/bin/`), regexp.MustCompile(`(?i)^/usr/bin/`), regexp.MustCompile(`(?i)^/sbin/`), regexp.MustCompile(`(?i)^/usr/sbin/`), regexp.MustCompile(`(?i)^\.\./`), regexp.MustCompile(`(?i)/\.\./`), regexp.MustCompile(`(?i)^(bash|sh|zsh|ksh|csh|tcsh|fish|dash)$`), regexp.MustCompile(`(?i)^(curl|wget|nc|netcat|ncat)$`), regexp.MustCompile(`(?i)^(rm|dd|mkfs|fdisk)$`), }
DangerousArgPatterns contains patterns that indicate potentially dangerous arguments
var DangerousEnvVarPatterns = []*regexp.Regexp{ regexp.MustCompile(`(?i)^LD_PRELOAD$`), regexp.MustCompile(`(?i)^LD_LIBRARY_PATH$`), regexp.MustCompile(`(?i)^DYLD_`), regexp.MustCompile(`(?i)^PATH$`), regexp.MustCompile(`(?i)^PYTHONPATH$`), regexp.MustCompile(`(?i)^NODE_OPTIONS$`), regexp.MustCompile(`(?i)^BASH_ENV$`), regexp.MustCompile(`(?i)^ENV$`), regexp.MustCompile(`(?i)^SHELL$`), }
DangerousEnvVarPatterns contains patterns for dangerous environment variable names or values
var ErrEncryptedDataMissingKey = errors.New("encrypted data found but SYSTEM_AES_KEY is not set or has wrong length")
ErrEncryptedDataMissingKey is returned by DecryptStoredSecret when the value carries the enc:v1: prefix but no AES key is available to decrypt it. This signals an operator misconfiguration (typically a rotated or unset SYSTEM_AES_KEY) and must propagate so the system fails loudly instead of silently using ciphertext as a credential.
var ErrSSRFRedirectBlocked = fmt.Errorf("redirect blocked: target URL failed SSRF validation")
ErrSSRFRedirectBlocked is returned when a redirect target is blocked due to SSRF protection
Functions ¶
func CopyDir ¶
CopyDir copies the contents of srcDir into dstDir, preserving the directory structure. dstDir is created if it does not exist. Existing files in dstDir may be overwritten.
func CopyDirectory ¶
CopyDirectory copies the entire srcDir directory (not just its contents) into dstParentDir. For example, CopyDirectory("/a/foo", "/b") creates /b/foo/ with all files/dirs from /a/foo.
func DecryptAESGCM ¶
DecryptAESGCM decrypts an AES-256-GCM encrypted string. If the string lacks the enc:v1: prefix, it's treated as legacy plaintext and returned as-is.
func DecryptStoredSecret ¶
DecryptStoredSecret decrypts a value loaded from the database with strict error propagation. Use this from GORM Scan/AfterFind hooks for any field that stores AES-encrypted secrets (API keys, passwords, app secrets).
Behaviour:
- empty input -> empty output, no error.
- no enc:v1: prefix -> returned as-is (legacy plaintext column), no error.
- has enc:v1: prefix and SYSTEM_AES_KEY is missing or wrong length -> returns ErrEncryptedDataMissingKey. Callers MUST propagate this so the load fails loudly instead of silently surfacing ciphertext as a credential.
- has enc:v1: prefix and key is set -> decrypts, returns any decryption error verbatim (e.g. base64 decode failure, GCM auth tag mismatch from a rotated key).
The previous lenient pattern (`if decrypted, err := ...; err == nil { ... }`) hid the rotated-key case and caused the encrypted ciphertext to be sent upstream as the actual API key, surfacing as 401/403 from third-party vendors. Always prefer this helper over calling DecryptAESGCM directly when loading from the database.
func EncryptAESGCM ¶
EncryptAESGCM encrypts plaintext with AES-256-GCM. Returns the original string if empty, already encrypted, or key is nil.
func GenerateID ¶
func GenerateID() int64
func GetAESKey ¶
func GetAESKey() []byte
GetAESKey reads the 32-byte AES key from SYSTEM_AES_KEY env. Returns nil if not set or not exactly 32 bytes.
func GetAnalysisDebugDir ¶
func GetAnalysisDir ¶
func GetAnalysisNodeDir ¶
func GetCurrentTime ¶
func GetProjectDir ¶
func GetProjectDocDir ¶
func GetScriptDir ¶
func GetScriptFile ¶
func GetScriptFileDir ¶
func GetWorkflowDir ¶
func InitSnowflake ¶
func IsPublicIP ¶
IsPublicIP returns true if the IP is safe for outbound fetch (not private, loopback, link-local, etc.). Used for DNS pinning: after resolving a hostname we pick the first public IP and pin all requests to it.
func IsSSRFWhitelisted ¶
IsSSRFWhitelisted checks whether the given hostname (or IP string) is covered by the SSRF_WHITELIST environment variable.
func NewSSRFSafeHTTPClient ¶
func NewSSRFSafeHTTPClient(config SSRFSafeHTTPClientConfig) *http.Client
NewSSRFSafeHTTPClient creates an HTTP client that validates redirect targets against SSRF protections. This prevents SSRF attacks via HTTP redirects where an attacker's server redirects to internal services.
func ResolveConfiguredPath ¶
func ResolveConfiguredPath(configuredPath string, defaultRelativeToExecutable string) (string, error)
ResolveConfiguredPath resolves storage path by this rule: - when configuredPath is empty, use executableDir/defaultRelativeToExecutable - otherwise, use configuredPath directly.
func ResolveExternalPath ¶
ResolveExternalPath resolves project external file paths. If BRAVE_CONFIG_DIR is set, the path is resolved relative to it; otherwise, it is resolved relative to current working directory.
func ResolveImageDir ¶
func SSRFSafeDialContext ¶
SSRFSafeDialContext is a custom dial function that validates the resolved IP addresses before establishing a connection. This provides an additional layer of SSRF protection against DNS rebinding attacks during the connection phase.
func SafeFileName ¶
SafeFileName 校验并返回安全的“仅文件名”部分，防止路径遍历。 仅保留最后一个路径成分，禁止 ".."、空名或仅含点，用于 SaveBytes 等场景。
func SafeObjectKey ¶
SafeObjectKey 校验对象存储的 key（如 COS/MinIO objectName），禁止包含 ".." 等路径遍历
func SafePathUnderBase ¶
SafePathUnderBase 校验 filePath 是否落在 baseDir 下，防止路径遍历（如 ../../）。 返回规范化的绝对路径；若路径逃逸出 baseDir 则返回错误。
func SanitizeForLog ¶
SanitizeForLog 清理日志输入,防止日志注入攻击 日志注入攻击是指攻击者通过在输入中插入换行符和其他控制字符, 伪造日志条目,可能导致日志分析工具误判或隐藏恶意活动
func SanitizeForLogArray ¶
SanitizeForLogArray 清理日志输入数组,防止日志注入攻击
func ValidateStdioArgs ¶
ValidateStdioArgs validates the arguments for MCP stdio transport Returns an error if any argument contains dangerous patterns
func ValidateStdioCommand ¶
ValidateStdioCommand validates the command for MCP stdio transport Returns an error if the command is not in the whitelist or contains dangerous patterns
func ValidateStdioConfig ¶
ValidateStdioConfig performs comprehensive validation of stdio configuration This should be called before creating or executing any stdio-based MCP client
func ValidateStdioEnvVars ¶
ValidateStdioEnvVars validates environment variables for MCP stdio transport Returns an error if any env var name or value is dangerous
func ValidateURLForSSRF ¶
ValidateURLForSSRF is the centralised entry-point that all handlers should call to validate a user-supplied URL. It first checks the SSRF_WHITELIST; whitelisted hosts skip the full isSSRFSafeURL check.
rawURL may be a full URL ("https://example.com/v1") or a bare host/host:port (for cases like ReconnectDocReader). If a scheme is missing the function prepends "https://" before parsing so that net/url can extract the host.
Returns nil when the URL is safe, or an error describing the problem.
Types ¶
type SSRFSafeHTTPClientConfig ¶
type SSRFSafeHTTPClientConfig struct {
Timeout time.Duration
MaxRedirects int
DisableKeepAlives bool
DisableCompression bool
}
SSRFSafeHTTPClientConfig contains configuration for the SSRF-safe HTTP client
func DefaultSSRFSafeHTTPClientConfig ¶
func DefaultSSRFSafeHTTPClientConfig() SSRFSafeHTTPClientConfig
DefaultSSRFSafeHTTPClientConfig returns the default configuration
Source Files