# Create a virtual environment
python3 -m venv venv
source venv/bin/activate

# Install essential security and networking libraries
pip install requests flask pydantic python-dotenv colorama

# Initialize project
npm init -y

# Install dependencies
# express: for the interceptor server
# axios: for making secure requests
# dotenv: for environment variable management
npm install express axios dotenv zod
npm install --save-dev typescript @types/node @types/express

import os
import logging
from typing import Dict, List
from dotenv import load_dotenv

# Load environment variables
load_dotenv()

# Configure Logging
logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
logger = logging.getLogger("SquidbleedAuditor")

class SquidbleedAuditor:
    def __init__(self, sensitive_headers: List[str]):
        self.sensitive_headers = sensitive_headers

    def audit_headers(self, headers: Dict[str, str]) -> bool:
        """
        Checks if sensitive headers are present in unencrypted or suspicious proxy contexts.
        Returns True if a leak is detected.
        """
        detected_leaks = []
        
        for header in self.sensitive_headers:
            # Check if the header exists in the request
            if header in headers:
                # In a real scenario, we'd check if this is being passed 
                # through an insecure proxy (HTTP vs HTTPS)
                detected_leaks.append(header)
        
        if detected_leaks:
            logger.error(f"CRITICAL: Potential Squidbleed leak detected! Leaked headers: {detected_leaks}")
            return True
        
        logger.info("Audit passed: No sensitive header leaks detected.")
        return False

def main():
    # Define headers we want to protect
    PROTECTED_HEADERS = ["Authorization", "Cookie", "Set-Cookie", "X-Api-Key"]
    
    auditor = SquidbleedAuditor(PROTECTED_HEADERS)

    # Mocking a suspicious request that might be intercepted by a vulnerable Squid proxy
    suspicious_request = {
        "Host": "api.secure-service.com",
        "Authorization": "Bearer secret_token_12345",
        "User-Agent": "Mozilla/5.0",
        "X-Squid-Proxy-ID": "leaky-proxy-01" # Simulating proxy metadata
    }

    try:
        is_leaking = auditor.audit_headers(suspicious_request)
        if is_leaking:
            # Trigger incident response logic here
            print("🚨 ALERT: Security breach protocol initiated.")
        else:
            print("✅ Traffic is clean.")
            
    except Exception as e:
        logger.error(f"Failed to run audit: {e}")

if __name__ == "__main__":
    main()

import express, { Request, Response, NextFunction } from 'express';
import dotenv from 'dotenv';
import { z } from 'zod';

dotenv.config();

const app = express();
app.use(express.json());

// Define a schema for valid incoming requests to prevent header injection
const HeaderSchema = z.object({
    host: z.string(),
    userAgent: z.string().optional(),
});

/**
 * Squidbleed Mitigation Middleware
 * Purpose: Sanitizes outgoing requests by ensuring sensitive 
 * credentials aren't attached to unencrypted proxy hops.
 */
const squidbleedMitigationMiddleware = (req: Request, res: Response, next: NextFunction) => {
    const sensitiveHeaders = ['authorization', 'cookie', 'proxy-authorization'];
    
    // 1. Log the attempt for audit trails
    console.log(`[Audit] Processing request to: ${req.url}`);

    // 2. Logic: If the connection is not TLS/SSL, strip sensitive headers
    // This prevents the "Squidbleed" leak where data is sent over cleartext proxy hops
    const isSecure = req.secure || req.headers['x-forwarded-proto'] === 'https';

    if (!isSecure) {
        console.warn('⚠️ INSECURE CONNECTION DETECTED: Stripping sensitive headers to prevent leak.');
        sensitiveHeaders.forEach(header => {
            delete req.headers[header];
        });
    }

    next();
};

app.use(squidbleedMitigationMiddleware);

app.get('/api/data', (req: Request, res: Response) => {
    res.json({ message: "Secure data retrieved successfully." });
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
    console.log(`🚀 Secure Interceptor running on port ${PORT}`);
});

# Security Settings
NODE_ENV=production
PORT=3000

# Sensitive Headers to Monitor (Comma separated)
MONITORED_HEADERS=Authorization,Cookie,X-Api-Key

# Alerting Webhook (e.g., Slack or PagerDuty)
SECURITY_ALERT_WEBHOOK=https://hooks.slack.com/services/T000/B000/XXXX

# Pattern: Fail-Closed
def secure_request_handler(request):
    try:
        validate_security(request) # If this raises an error, the code below never runs
        return send_to_proxy(request)
    except SecurityException:
        return block_request() # Better to break the app than leak data