# Create a virtual environment
python -m venv venv
source venv/bin/activate

# Install necessary security and web libraries
pip install fastapi uvicorn pydantic email-validator bleach

# Initialize project
npm init -y

# Install dependencies
# fastapi/pydantic equivalent in JS: Express and Zod
npm install express zod helmet cors dotenv
npm install --save-dev typescript @types/node @types/express ts-node

from fastapi import FastAPI, HTTPException, Request
from pydantic import BaseModel, Field, validator
import bleach
import uvicorn

app = FastAPI()

# Schema defining strict input rules
# This prevents attackers from passing unexpected characters used in RCE (e.g., ;, |, `)
class SecurePayload(BaseModel):
    username: str = Field(..., min_length=3, max_length=20)
    comment: str = Field(..., max_length=500)
    user_id: int

    @validator('username')
    def sanitize_username(cls, v):
        # Allow only alphanumeric characters to prevent command injection characters
        if not v.isalnum():
            raise ValueError('Username must be alphanumeric')
        return v

    @validator('comment')
    def sanitize_comment(cls, v):
        # Strip all HTML and potentially dangerous characters
        # This is critical if the data is later processed by a shell command
        clean_text = bleach.clean(v, tags=[], strip=True)
        return clean_text

@app.post("/validate-request")
async def validate_request(payload: SecurePayload):
    try:
        # If validation passes, we proceed to call the Rails backend
        # In a real scenario, use httpx to forward the sanitized payload
        return {
            "status": "secure",
            "sanitized_data": payload.dict()
        }
    except Exception as e:
        raise HTTPException(status_code=400, detail=str(e))

if __name__ == "__main__":
    uvicorn.run(app, host="0.0.0.0", port=8000)

import express, { Request, Response, NextFunction } from 'express';
import { z } from 'zod';
import helmet from 'helmet';
import cors from 'cors';

const app = express();

// Middleware for security headers
app.use(helmet());
app.use(cors());
app.use(express.json());

// Zod Schema: Strict validation to prevent RCE via parameter injection
const UserSchema = z.object({
  username: z.string().min(3).max(20).regex(/^[a-zA-Z0-9]+$/, "Only alphanumeric allowed"),
  bio: z.string().max(200).transform((val) => val.replace(/[;&|`]/g, "")), // Sanitize shell meta-characters
  age: z.number().int().positive()
});

// Validation Middleware
const validatePayload = (req: Request, res: Response, next: NextFunction) => {
  const result = UserSchema.safeParse(req.body);
  
  if (!result.success) {
    return res.status(400).json({
      error: "Invalid input detected",
      details: result.error.errors
    });
  }
  
  // Replace req.body with the sanitized version from Zod
  req.body = result.data;
  next();
};

app.post('/api/v1/user/update', validatePayload, (req: Request, res: Response) => {
  // At this point, data is guaranteed to be safe from common RCE characters
  const { username, bio } = req.body;
  
  console.log(`Processing safe request for: ${username}`);
  
  res.status(200).json({
    message: "Data validated and ready for backend processing",
    received: req.body
  });
});

const PORT = 3000;
app.listen(PORT, () => {
    console.log(`Security Proxy running on port ${PORT}`);
});

# The internal Rails API address (not exposed to public internet)
RAILS_BACKEND_URL=http://internal-rails-app:3000/api/v1

# Secret key for internal service-to-service communication
INTERNAL_API_TOKEN=your_highly_secure_random_string

# Logging level
LOG_LEVEL=info