File: //usr/local/CyberCP/aiScanner/__pycache__/api.cpython-310.pyc
o
��h�j � @ s� d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
d dl m Z d dl
mZ ddlmZmZ d d lmZ G d
d � d e�Zd d
� Zdd� Zee
dg�dd� ��Zee
dg�dd� ��Zee
dg�dd� ��Zee
dg�dd� ��Z dS )� N)� JsonResponse)� csrf_exempt)�require_http_methods��Websites)�
Administrator� )�FileAccessToken� ScanHistory)�CyberCPLogFileWriterc @ s e Zd ZdZdS )�
SecurityErrorz(Custom exception for security violationsN)�__name__�
__module__� __qualname__�__doc__� r r �#/usr/local/CyberCP/aiScanner/api.pyr s r c
C s� zW| r| � d�s t�d| r| dd� nd� d�� W dS z'tjj| |dd �}|�� r6t�d
|� �� W W d S t�d |� �� |dfW W S tjyW t�d
|� �� Y W dS w tyt } zt�dt |�� �� W Y d}~dS d}~ww )z�
Implement proper token validation
- Check token format
- Verify token hasn't expired
- Confirm token is for the correct scan
- Log access attempts
�cp_z [API] Invalid token format: N� �Nonez...)NzInvalid token formatT)�token�scan_history__scan_id� is_activez [API] Token expired for scan )Nz
Token expiredz,[API] Token validated successfully for scan z [API] Token not found for scan )Nz
Invalid tokenz [API] Token validation error: )NzToken validation failed)
�
startswith�logging� writeToFiler �objects�get�
is_expired� DoesNotExist� Exception�str)r �scan_id�
file_token�er r r �validate_access_token s0 "� ���r% c
C sz z'|rt j�| |�d��}n| }t j�|�}t j�| �} |�| �s%td��|W S ty< } z tdt|�� ���d}~ww )zc
Ensure requested path is within allowed directory
Prevent directory traversal attacks
�/z Path outside allowed directoryz Path security check failed: N) �os�path�join�strip�abspathr r r r! )� base_path�requested_path� full_pathr$ r r r �secure_path_check9 s
��r/ �POSTc
C s� �z2t �| j�}|�d�}|�d�}|�dd�}t�d|� d|� �� |r'|s0tddid d
�W S t||�\}}|rBtd|id d
�W S z�tj j|j
d �}|j }d
} d
}
t j
�|dd�} zKddlm} d| � d�}
| j|
|jdd�}|d r�|d }ddl}|�d|�}|r�|�d�} t�d| � �� nt�dt|�dkr�|d nd� �� W n ty� } zt�d t|�� �� W Y d}~nd}~ww z(ddl}|jd d gddd d �}|jdkr�ddl}|�d!|j �}|r�|�d�}
W n ty� Y nw d|j
||
| |d"�d#d$g|j � d%�d&�}t�d'|j
� �� t|�W W S tj �y3 t�d(|j
� �� tdd)id*d
� Y W S w t j �yF tdd+id d
� Y S t�yj } zt�d,t|�� �� tdd-id.d
�W Y d}~S d}~ww )/aH
POST /api/ai-scanner/authenticate
Request Body:
{
"access_token": "cp_access_abc123...",
"scan_id": "550e8400-e29b-41d4-a716-446655440000",
"worker_id": "scanner-1.domain.com"
}
Response:
{
"success": true,
"site_info": {
"domain": "client-domain.com",
"wp_path": "/home/client/public_html",
"php_version": "8.1",
"wp_version": "6.3.1"
},
"permissions": ["read_files", "list_directories"],
"expires_at": "2024-12-25T11:00:00Z"
}
� access_tokenr" � worker_id�unknownz)[API] Authentication request from worker �
for scan �errorz Missing access_token or scan_id� ��status� ��domain�Unknownz wp-includesz version.phpr ��ProcessUtilities�cat "�"T��user� retRequiredr Nz&\$wp_version\s*=\s*[\'"]([^\'"]+)[\'"]z"[API] Detected WordPress version: z&[API] Could not read WP version file: �No content returnedz [API] Error reading WP version: �phpz-v� )�capture_output�text�timeoutzPHP (\d+\.\d+))r; �wp_path� php_version�
wp_versionr" �
read_files�list_directoriesz%Y-%m-%dT%H:%M:%SZ)�success� site_info� permissions�
expires_atz$[API] Authentication successful for z[API] Website not found: �Website not found� z Invalid JSONz [API] Authentication error: zAuthentication failed�� )!�json�loads�bodyr r r r r% r r r; rJ r' r( r) �plogical.processUtilitiesr> �outputExecutioner� externalApp�re�search�group�lenr r! �
subprocess�run�
returncode�stdoutrR �strftimer �JSONDecodeError)�request�datar1 r" r2 r# r5 �websiterJ rL rK � version_filer> �command�result�contentr\ �matchr$ r` �
response_datar r r �authenticate_workerO s�
�$� ��
� ��
�
� ��ro �GETc
C s� �z�| j �dd�}|�d�stddidd�W S |�dd�}| j �dd�}|s/tdd id
d�W S t||�\}}|rAtd|idd�W S | j�d d��d �}�zZt|j |�}g }�zd
dl
m } d
dl m
}
z
|
jj|jd�} | j} W n |
jy� tddidd� Y W W W S w d|� d�}
| j|
| dd�}|d �r>|d �� �d�}|dd� D ]�}|�� s�q�|�� }t|�dk r�q�|d
}|d �� r�|d nd
}d �|d d� �}|�d �s�|d v s�|d v r�q�||�d!�r�d"nd#t|�dkr�|dd� nd$d%�}|�d&��r#zt|�|d'< W n t�y d
|d'< Y nw |�d(��r"|�|� q�|�d!��r3d
|d'< |�|� q�d
|d'< |�|� q�n t� d)t|�dk�rL|d nd*� �� tdd+id,d�W W W S W n' t �y� } zt� d-t |�� �� tdd+id,d�W Y d}~W W S d}~ww t� d.t|�� d/|�p�d0� d1|� �� t|t |d2d3� d4�d5��W W S t �y� } zt� d6t |�� �� tdd7id,d�W Y d}~W S d}~ww t �y� } zt� d8t |�� �� tdd9id:d�W Y d}~S d}~ww );a�
GET /api/ai-scanner/files/list?path=wp-content/plugins
Headers:
Authorization: Bearer cp_access_abc123...
X-Scan-ID: 550e8400-e29b-41d4-a716-446655440000
Response:
{
"path": "wp-content/plugins",
"items": [
{
"name": "akismet",
"type": "directory",
"modified": "2024-12-20T10:30:00Z"
},
{
"name": "suspicious-plugin.php",
"type": "file",
"size": 15420,
"modified": "2024-12-24T15:20:00Z",
"permissions": "644"
}
]
}
�HTTP_AUTHORIZATION� �Bearer r5 �'Missing or invalid Authorization headerr9 r7 �HTTP_X_SCAN_ID�X-Scan-ID header requiredr6 r( r& r r= r r: rS rT zls -la "r@ TrA r �
N� � � � �.)r| z..)� __pycache__� node_modules�d� directory�file�644)�name�typerQ �-�size)�.php�.js�.html�.htm�.css�.txt�.md�.json�.xml�.sql�.log�.conf�.ini�.yml�.yamlz [API] Directory listing failed: rD zDirectory access failed� z [API] Directory listing error: z
[API] Listed z
items in �rootr4 c S s | d dk| d � � fS )Nr� r� r� )�lower)�xr r r �<lambda>< s z list_files.<locals>.<lambda>)�key)r( �items�[API] Security violation: �Path not allowedz[API] List files error: �Internal server errorrU )!�METAr r r �replacer% rp r* r/ rJ rY r> �websiteFunctions.modelsr r r; r[ r rZ �splitr_ �isdigitr) �int�
ValueError�endswith�appendr r r r! �sortedr )rf � auth_headerr1 r" r# r5 r( r. r� r> r rh rB �
ls_commandrk �lines�line�partsrQ r� r� � item_datar$ r r r �
list_files� s�
�
� �
� �&(�+ ��& � �� ��r� c
C sX �z| j �dd�}|�d�stddidd�W S |�dd�}| j �dd�}|s/tdd id
d�W S | j�d d��d �}|sDtdd
id
d�W S t||�\}}|rVtd|idd�W S �z�t|j |�}h d�}t
j � |�d �
� } | |vr}tdd| � �idd�W W S z�ddlm}
ddlm} z
| jj|jd�} | j}
W n | jy� tddidd� Y W W W S w d|� d�}|
j||
dd�}|d r�zt|d �� �}|d kr�tdd id
d�W W W W S W n2 ty� t�d |d � �� d}Y n w t�d t|�dkr�|d nd � �� tdd!idd�W W W S d"|� d�}|
j||
dd�}t|�dk�r1|d d#u�r,|d nd}d$}nt�d%� tdd&id
d�W W W S W n' t �yi } zt�d't |�� �� tdd&id
d�W Y d#}~W W S d#}~ww t � |�\}}|�s�| d(k�r|d)}n
| d*k�r�d+}nd,}z
t �!|�"d$���#d$�}W n3 t$�y� zt �!|�"d-���#d$�}d-}W n t�d.|� �� tdd/id
d� Y Y W W S Y nw t�d0|� d1|� d2|� �� t|||||d3��W W S t%�y } zt�d4t |�� �� tdd5idd�W Y d#}~W S d#}~ww t �y+ } zt�d6t |�� �� tdd7id8d�W Y d#}~S d#}~ww )9a�
GET /api/ai-scanner/files/content?path=wp-content/plugins/plugin.php
Headers:
Authorization: Bearer cp_access_abc123...
X-Scan-ID: 550e8400-e29b-41d4-a716-446655440000
Response:
{
"path": "wp-content/plugins/plugin.php",
"content": "<?php
// Plugin code here...",
"size": 15420,
"encoding": "utf-8",
"mime_type": "text/x-php"
}
rq rr rs r5 rt r9 r7 ru rv r6 r( r& zFile path required> r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r zFile type not allowed: r� r r= r r: rS rT z stat -c %s "r@ TrA i � zFile too large (max 10MB)z![API] Could not parse file size: z [API] Could not get file size: rD z File not found or inaccessibler? Nzutf-8z*[API] File read failed: No result returnedzUnable to read filez[API] File read error: r� z
text/x-phpr� zapplication/javascriptz
text/plainzlatin-1z([API] Failed to encode file content for zFile encoding not supportedz [API] File content retrieved: z (z bytes) for scan )r( rl r� �encoding� mime_typer� r� z [API] Get file content error: r� rU )&r� r r r r� rp r* r% r/ rJ r' r( �splitextr� rY r> r� r r r; r[ r rZ r� r� r r r_ r r! � mimetypes�
guess_type�base64� b64encode�encode�decode�UnicodeEncodeErrorr )rf r� r1 r" r( r# r5 r. �allowed_extensions�file_extr> r rh rB � stat_command� stat_result� file_size� cat_commandrk rl r� r$ r� �_�content_base64r r r �get_file_contentH s�
� � �$
� ��
�� � �� ��r� c
C sj �zut �| j�}|�d�}|�d�}|�di �}|�dg �}|�dd�}|�d�}t�d|� d |� �� �z�d
d lm} d d
lm } d dl
}
|j j|d�} || _ |�dd �| _
|�dd �| _|�dd�} zt| �dd��dd��}
|
| _W n ttfy� d| _Y nw | �|� |�dd�|�dd �|�dd �|d�}| �|� |r�z|
j
�|�dd��}|| _W n ty� | �� | _Y nw | �� | _| �� zpd
d lm} |j j |d�\}}d |_ d |_ |�dd �|_ |�dd �|_d |_ |�dd �|_!d }d }|D ] }|�d d��"� }|d k�r|d
7 }q�|d!k�r|d
7 }q�||_#||_$d"|�dd �� d#�|_%|�� t�d$|� �� W n t&�yW } zt�d%t'|�� �� W Y d}~nd}~ww | jd k�r�z5| j(j)}|j*| jk�r�t|j*�t| j� |_*|�� t�d&| j� d'| j(j+� d(�� n t�d)| j� �� W n t&�y� } zt�d*t'|�� �� W Y d}~nd}~ww zd
d+lm,} |j j-| d,�j.d-d.� t�d/|� �� W n t&�y� } zt�d0t'|�� �� W Y d}~nd}~ww t�d1|� d2�� t�d3|� �� t�d4|�d�� �� t�d5|�d�� �� t�d6|�d�� �� t�d7|�d�� �� W nE |j/�yF t�d8|� �� t0d9d:|d;�d<d=� Y W S t&�ym } zt�d>t'|�� �� t0d9d?|d;�d@d=�W Y d}~W S d}~ww t0dAdB|d;��W S t j1�y� t�dC� t0d9dDdE�dFd=� Y S t&�y� } zt�dGt'|�� �� t0d9dHdE�d@d=�W Y d}~S d}~ww )Ia,
Receive scan completion callbacks from AI Scanner platform
POST /api/ai-scanner/callback
Content-Type: application/json
Expected payload:
{
"scan_id": "uuid",
"status": "completed",
"summary": {
"threat_level": "HIGH|MEDIUM|LOW",
"total_findings": 3,
"files_scanned": 25,
"cost": "$0.0456"
},
"findings": [
{
"file_path": "wp-content/plugins/file.php",
"severity": "CRITICAL|HIGH|MEDIUM|LOW",
"title": "Issue title",
"description": "Detailed description",
"ai_confidence": 95
}
],
"ai_analysis": "AI summary text",
"completed_at": "2025-06-23T11:40:12Z"
}
r" r8 �summary�findings� ai_analysisrr � completed_atz![API] Received callback for scan z: r )r
r )�timezoneN)r" �total_findings�
files_scanned�costz$0.00�$�,g � threat_level�UNKNOWN)r� r� r� r� �Zz+00:00)�ScanStatusUpdate� completed�d �severity�critical�highzScan completed - z threats foundz2[API] Updated ScanStatusUpdate for completed scan z'[API] Error updating ScanStatusUpdate: z[API] Deducted $z from z balancez+[API] Insufficient balance for scan cost: $z [API] Error updating balance: )r )� scan_historyF)r z.[API] Deactivated file access tokens for scan z![API] Error deactivating tokens: z [API] Scan z completed successfully:z[API] Status: z[API] Threat Level: z[API] Findings: z[API] Files Scanned: z[API] Cost: z [API] Scan record not found: r5 zScan record not found)r8 �messager" rT r7 z$[API] Failed to update scan record: z Failed to update scan recordrU rO z Callback received successfullyz&[API] Invalid JSON in callback requestzInvalid JSON payload)r8 r� r6 z![API] Callback processing error: r� )2rV rW rX r r r �modelsr
� django.utilsr� �datetimer r8 � issues_foundr� �floatr� �cost_usdr� �AttributeError� set_findings� set_summary�
fromisoformatr� �now�save�
status_modelsr� �
get_or_create�phase�progress�files_discovered�files_remaining�
threats_foundr� �critical_threats� high_threats�activity_descriptionr r! �admin�ai_scanner_settings�balance�userNamer �filter�updater r re )rf rg r" r8 r� r� r� r� r
r� r� � scan_record�cost_str�
cost_value� summary_dict�completed_datetimer� �
status_updater� �critical_count�
high_count�findingr� r$ �scanner_settingsr r r r �
scan_callback� s
�
�
�
� �� � �� ��� �����
�
�
�����r� ) rV r' �timer� r� � django.httpr � django.views.decorators.csrfr � django.views.decorators.httpr r� r �loginSystem.modelsr r� r r
� plogical.CyberCPLogFileWriterr r r r r% r/ ro r� r� r� r r r r �<module> s: % n