[mod_python] Getting Hostname

Greetings!

One way to avoid attacks of all kinds is to use Mod Security, which checks
the entire request against a security rule set.  Rule sets are defined
within the main Apache configuration file and look like this (highly
abbreviated) example:

SecFilter "\.\./" "deny,log,status:666"
SecFilterSelective REQUEST_METHOD "SEARCH" "deny,log,status:405"
SecFilterSelective REQUEST_URI "\.exe"  "deny,log,status:666"

The first rule shown protects against symbolic directory traversal for any
kind of request.  If ".." is found, the rule causes Apache to deny access,
log the request, and return an HTTPD status code of 666.  The second rule
denies any request with HTTPD method "search."  The last rule denies any
request with ".exe" in the URI.  You can write a rule for any HTTPD header
field or URI form, and define the action to take and what status code to
return.

I'm not sure about this, but I think that Mod Security works in Apache's
PostReadRequest phase, so it (probably) won't interfere with a Mod Python
Translation phase handler.  Mod Security is exhaustively documented and they
are very responsive to e-mail queries.

I can't say enough good things about Mod Security.  See www.modsecurity.org

Best Regards,
Lee E. Brown
(administrator at leebrown.org)

-----Original Message-----
From: mod_python-bounces at modpython.org
[mailto:mod_python-bounces at modpython.org] On Behalf Of Graham Dumpleton
Sent: Wednesday, November 15, 2006 4:12 PM
To: g.farina at pharaondev.com
Cc: mod_python at modpython.org
Subject: Re: [mod_python] Getting Hostname

NOTE, the above code may have to cleanup req.uri and normalise it before it
uses it to avoid attacks whereby people use '..' in a URI to try and get
access to files outside of the document tree. It might also normalise the
path after creating the combined path and ensuring the result still resides
within the document tree. If Apache has cleaned up req.uri already, this
will not be needed. I need to check for myself what Apache has already done
at that point as not sure.