# Create a virtual environment
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install necessary libraries for the security proxy
pip install fastapi uvicorn httpx python-dotenv

# Initialize project
npm init -y

# Install dependencies
npm install express axios dotenv helmet
npm install --save-dev typescript @types/node @types/express ts-node

import httpx
from fastapi import FastAPI, Request, Response, HTTPException
from fastapi.responses import StreamingResponse
import os
import re

app = FastAPI(title="ICARAX Security Proxy")

# Configuration
GEOSERVER_URL = os.getenv("GEOSERVER_URL", "http://localhost:8080/geoserver")

# Malicious Pattern Detection (Example: looking for common RCE injection characters)
# In a real zero-day scenario, these regex patterns are updated based on threat intel.
MALICIOUS_PATTERNS = [
    re.compile(r";\s*rm\s+-rf"),           # Command injection: rm -rf
    re.compile(r"(\||&|;)\s*(cat|ls|whoami)"), # Command chaining
    re.compile(r"\$\(.*\)")                 # Shell expansion $(...)
]

async def is_malicious(content: str) -> bool:
    """Checks if the request content contains known exploit patterns."""
    for pattern in MALICIOUS_PATTERNS:
        if pattern.search(content):
            return True
    return False

@app.api_route("/{path:path}", methods=["GET", "POST", "PUT", "DELETE"])
async def security_proxy(request: Request, path: str):
    """
    Intercepts all requests to GeoServer, inspects them, and forwards 
    them only if they pass security checks.
    """
    url = f"{GEOSERVER_URL}/{path}"
    
    # 1. Inspect Query Parameters
    query_params = str(request.query_params)
    if await is_malicious(query_params):
        raise HTTPException(status_code=403, detail="Security Violation: Malicious Query Detected")

    # 2. Inspect Request Body (for POST/PUT)
    body = await request.body()
    if body and await is_malicious(body.decode('utf-8', errors='ignore')):
        raise HTTPException(status_code=403, detail="Security Violation: Malicious Payload Detected")

    # 3. Forward the request to the real GeoServer
    async with httpx.AsyncClient() as client:
        # Prepare request for forwarding
        req_params = request.query_params
        headers = dict(request.headers)
        # Remove host header to prevent mismatching during proxying
        headers.pop("host", None)

        try:
            # Use stream for large geospatial datasets to maintain performance
            rp_resp = await client.request(
                method=request.method,
                url=url,
                params=req_params,
                content=body,
                headers=headers,
                timeout=30.0
            )
            
            return Response(
                content=rp_resp.content,
                status_code=rp_resp.status_code,
                headers=dict(rp_resp.headers)
            )
        except httpx.RequestError as exc:
            raise HTTPException(status_code=502, detail=f"Upstream Error: {str(exc)}")

if __name__ == "__main__":
    import uvicorn
    uvicorn.run(app, host="0.0.0.0", port=8000)

import express, { Request, Response, NextFunction } from 'express';
import axios, { AxiosRequestConfig } from 'axios';
import helmet from 'helmet';
import dotenv from 'dotenv';

dotenv.config();

const app = express();
app.use(helmet()); // Adds security headers
app.use(express.json({ limit: '5mb' })); // Limit body size to prevent DoS

const GEOSERVER_URL = process.env.GEOSERVER_URL || 'http://localhost:8080/geoserver';

// Security Regex: Targets common RCE characters used in unpatched exploits
const RCE_REGEX = /[\|&;]|(\$\()/i;

/**
 * Middleware to inspect incoming requests for RCE patterns
 */
const securityScanner = (req: Request, res: Response, next: NextFunction) => {
    const bodyString = JSON.stringify(req.body);
    const queryString = JSON.stringify(req.query);
    const urlString = req.url;

    // Combined check of URL, Query, and Body
    if (RCE_REGEX.test(urlString) || RCE_REGEX.test(queryString) || RCE_REGEX.test(bodyString)) {
        console.warn(`[SECURITY ALERT] Blocked malicious request from ${req.ip}: ${req.url}`);
        return res.status(403).json({
            error: 'Security Violation',
            message: 'Request blocked by ICARAX Security Layer'
        });
    }

    next();
};

app.use(securityScanner);

/**
 * Proxy Route
 */
app.all('*', async (req: Request, res: Response) => {
    const targetUrl = `${GEOSERVER_URL}${req.url}`;

    try {
        const response = await axios({
            method: req.method,
            url: targetUrl,
            data: req.body,
            params: req.query,
            headers: {...req.headers, host: 'geoserver-internal' },
            responseType: 'arraybuffer', // Crucial for handling geospatial binary data (GZIP/PNG)
            maxContentLength: 10 * 1024 * 1024, // 10MB limit
        });

        // Forward headers and content back to client
        res.set(response.headers);
        res.status(response.status).send(response.data);
    } catch (error: any) {
        const status = error.response?.status || 500;
        res.status(status).send(error.response?.data || 'Proxy Error');
    }
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => console.log(`ICARAX Security Proxy running on port ${PORT}`));

#.env file
# The internal, private IP of your GeoServer instance
GEOSERVER_URL=http://10.0.0.5:8080/geoserver

# The port the proxy will listen on
PORT=8000

# Logging level for security audits
LOG_LEVEL=info