Spaces:

megatrump
/

deno

Running

App Files Files Community

megatrump commited on 11 days ago

Commit

8c984b6

verified ·

1 Parent(s): ab21604

Update app.py

Browse files

Files changed (1) hide show

app.py +42 -34

app.py CHANGED Viewed

@@ -1,5 +1,6 @@
 import re
 import logging
 from flask import Flask, request, Response
 import requests
 from urllib.parse import urlparse, unquote
@@ -8,9 +9,15 @@ from urllib.parse import urlparse, unquote
 logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
 app = Flask(__name__)
 # --- Whitelisted URL Patterns for GitHub ---
-# This list defines all URL patterns that are permitted to be proxied.
-# It's a security measure to prevent the proxy from being used to access unintended domains.
 ALLOWED_PATTERNS = [
     # Repositories: releases, archives, blobs, raw content
     re.compile(r'^https://github\.com/[^/]+/[^/]+/(?:releases|archive)/.*$', re.IGNORECASE),
@@ -33,35 +40,34 @@ ALLOWED_PATTERNS = [
     re.compile(r'^https://github\.com/[^/]+/[^/]+/?$', re.IGNORECASE),
 ]
-# --- Custom Index Page ---
-INDEX_PAGE_HTML = """
 <!DOCTYPE html>
 <html lang="en">
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>GitHub Proxy</title>
     <style>
-        body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif; line-height: 1.6; color: #333; max-width: 800px; margin: 40px auto; padding: 20px; }
-        .container { border: 1px solid #ddd; border-radius: 8px; padding: 20px 40px; background-color: #f9f9f9; }
-        .warning { color: #856404; background-color: #fff3cd; border: 1px solid #ffeeba; padding: 15px; border-radius: 4px; margin-bottom: 20px; }
-        h1, h2 { border-bottom: 1px solid #eaecef; padding-bottom: 0.3em; }
-        code { background-color: #eef; padding: 2px 4px; border-radius: 3px; }
     </style>
 </head>
 <body>
     <div class="container">
-        <h1>GitHub Reverse Proxy</h1>
         <div class="warning">
-            <strong>Warning:</strong> You are accessing GitHub content through a reverse proxy.
-            All content served from this page is provided directly by GitHub.
         </div>
         <h2>How to Use</h2>
-        <p>To access GitHub content, simply append the GitHub URL to this proxy's address.</p>
         <p>For example, to clone a repository:</p>
-        <code>git clone {YOUR_PROXY_URL}/https://github.com/owner/repo.git</code>
         <p>Or to view a repository page:</p>
-        <code>{YOUR_PROXY_URL}/https://github.com/owner/repo</code>
     </div>
 </body>
 </html>
@@ -74,24 +80,31 @@ def is_url_allowed(url):
             return True
     return False
-# --- Core Proxy Logic ---
 @app.route('/', defaults={'path': ''}, methods=['GET', 'POST', 'PUT', 'DELETE'])
 @app.route('/<path:path>', methods=['GET', 'POST', 'PUT', 'DELETE'])
 def proxy(path):
     """
-    Proxies requests to GitHub after validating them against a whitelist.
-    It streams the response back to the client.
     """
-    # The full path might be URL-encoded, so we decode it.
-    target_path = unquote(request.full_path)
-    if target_path.startswith('/'):
-        target_path = target_path[1:]
-    # For the root path, display the custom warning page.
-    # Handle both '' (for a request to '/') and '?' (for a request to '/?').
-    if not target_path or target_path == '?':
         return INDEX_PAGE_HTML, 200
     # Prepend 'https://' if the scheme is missing.
     if not target_path.startswith(('http://', 'https://')):
         target_url = 'https://' + target_path
@@ -100,7 +113,7 @@ def proxy(path):
     # Security check: Ensure the URL is in the whitelist.
     if not is_url_allowed(target_url):
-        logging.warning(f"URL Denied! No pattern matched: {target_url}")
         return "<h1>403 Forbidden</h1><p>Request blocked by proxy security policy.</p>", 403
     try:
@@ -116,24 +129,19 @@ def proxy(path):
     headers['Host'] = target_host
     try:
-        # Stream the request to handle large files efficiently.
         resp = requests.request(
             method=request.method,
             url=target_url,
             headers=headers,
             data=request.get_data(),
             cookies=request.cookies,
-            allow_redirects=False, # Redirects are handled by the client.
             stream=True,
-            timeout=30  # Timeout for the connection.
         )
-        # Exclude headers that can interfere with streaming.
         excluded_headers = ['content-encoding', 'content-length', 'transfer-encoding', 'connection']
         response_headers = [(name, value) for (name, value) in resp.raw.headers.items()
                             if name.lower() not in excluded_headers]
-        # Stream the response back to the original client.
         return Response(resp.iter_content(chunk_size=8192), resp.status_code, response_headers)
     except requests.exceptions.RequestException as e:

 import re
 import logging
+import os
 from flask import Flask, request, Response
 import requests
 from urllib.parse import urlparse, unquote
 logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
 app = Flask(__name__)
+# --- Authentication Configuration ---
+# Read the secret key from an environment variable.
+# The service will not start if this key is not set for security reasons.
+SECRET_KEY = os.environ.get('PROXY_SECRET_KEY')
+if not SECRET_KEY:
+    logging.critical("FATAL: Environment variable PROXY_SECRET_KEY is not set. Service cannot start.")
+    exit("Error: The PROXY_SECRET_KEY environment variable must be set.")
 # --- Whitelisted URL Patterns for GitHub ---
 ALLOWED_PATTERNS = [
     # Repositories: releases, archives, blobs, raw content
     re.compile(r'^https://github\.com/[^/]+/[^/]+/(?:releases|archive)/.*$', re.IGNORECASE),
     re.compile(r'^https://github\.com/[^/]+/[^/]+/?$', re.IGNORECASE),
 ]
+# --- Custom Index Page (Updated with Authentication Info) ---
+INDEX_PAGE_HTML = f"""
 <!DOCTYPE html>
 <html lang="en">
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Private GitHub Proxy</title>
     <style>
+        body {{ font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif; line-height: 1.6; color: #333; max-width: 800px; margin: 40px auto; padding: 20px; }}
+        .container {{ border: 1px solid #ddd; border-radius: 8px; padding: 20px 40px; background-color: #f9f9f9; }}
+        .warning {{ color: #856404; background-color: #fff3cd; border: 1px solid #ffeeba; padding: 15px; border-radius: 4px; margin-bottom: 20px; }}
+        h1, h2 {{ border-bottom: 1px solid #eaecef; padding-bottom: 0.3em; }}
+        code {{ background-color: #eef; padding: 2px 4px; border-radius: 3px; font-family: "SFMono-Regular", Consolas, "Liberation Mono", Menlo, Courier, monospace; }}
     </style>
 </head>
 <body>
     <div class="container">
+        <h1>Private GitHub Reverse Proxy</h1>
         <div class="warning">
+            <strong>Authentication Required:</strong> This is a private proxy. You must include your secret key in the URL to access content.
         </div>
         <h2>How to Use</h2>
+        <p>To access GitHub content, prepend your secret key to the GitHub URL.</p>
         <p>For example, to clone a repository:</p>
+        <code>git clone {{YOUR_PROXY_URL}}/{SECRET_KEY}/https://github.com/owner/repo.git</code>
         <p>Or to view a repository page:</p>
+        <code>{{YOUR_PROXY_URL}}/{SECRET_KEY}/https://github.com/owner/repo</code>
     </div>
 </body>
 </html>
             return True
     return False
+# --- Core Proxy Logic (Updated with Authentication) ---
 @app.route('/', defaults={'path': ''}, methods=['GET', 'POST', 'PUT', 'DELETE'])
 @app.route('/<path:path>', methods=['GET', 'POST', 'PUT', 'DELETE'])
 def proxy(path):
     """
+    Authenticates the request via a secret key in the path, then proxies
+    the request to GitHub after validating it against a whitelist.
     """
+    # Split the path to separate the secret key from the target URL.
+    # e.g., "mysecretkey/https://github.com/user/repo" -> ["mysecretkey", "https://..."]
+    path_parts = path.split('/', 1)
+    # --- Authentication Check ---
+    # The path must contain a key. If not, or if the key is wrong, deny access.
+    if len(path_parts) < 1 or path_parts[0] != SECRET_KEY:
+        logging.warning(f"Authentication failed for request from {request.remote_addr}. Path: '{path}'")
+        return "<h1>401 Unauthorized</h1><p>A valid secret key is required in the URL path.</p>", 401
+    # If the key is correct but there is no target URL, show the index page.
+    # This happens when accessing /<secret_key>/
+    if len(path_parts) == 1 or not path_parts[1]:
         return INDEX_PAGE_HTML, 200
+    target_path = unquote(path_parts[1])
     # Prepend 'https://' if the scheme is missing.
     if not target_path.startswith(('http://', 'https://')):
         target_url = 'https://' + target_path
     # Security check: Ensure the URL is in the whitelist.
     if not is_url_allowed(target_url):
+        logging.warning(f"URL Denied! Key was correct, but pattern not matched: {target_url}")
         return "<h1>403 Forbidden</h1><p>Request blocked by proxy security policy.</p>", 403
     try:
     headers['Host'] = target_host
     try:
         resp = requests.request(
             method=request.method,
             url=target_url,
             headers=headers,
             data=request.get_data(),
             cookies=request.cookies,
+            allow_redirects=False,
             stream=True,
+            timeout=30
         )
         excluded_headers = ['content-encoding', 'content-length', 'transfer-encoding', 'connection']
         response_headers = [(name, value) for (name, value) in resp.raw.headers.items()
                             if name.lower() not in excluded_headers]
         return Response(resp.iter_content(chunk_size=8192), resp.status_code, response_headers)
     except requests.exceptions.RequestException as e: