POST-内容审查-Web通道

接口介绍

Web通道内容审查接口用于检测用户在Web通道中上传的共享文件内容是否违反企业或组织的数据防泄漏DLP策略，并执行允许数据传输，或阻断数据传输等响应动作。

请求方式

接口地址

请求参数

请求中的Body参数定义。

请求示例

以下示例为调用接口分别在同步模式和异步模式下，发送数据至统一内容安全审查平台UCWI进行内容安全检测。

• 同步状态：

  POST /skg/v1/dlp/channel/web/http/sync
  Content-Type: multipart/form-data; boundary=${bound}
  --${bound}
  Content-Disposition: form-data; name="metadata"
  Content-Type: application/json
  {
  "sourceAddress":"123.12.12.112",
  "user":"abc\enduser1",
  "url":"http://www.sina.com.cn/forum/post.action",
  "httpBodyLen" : 10240,
  "queryID" : "1024f306-566a-415f-9ada-1be89b9f1086",
  "httpHeader":"Host: testhost.com\r\nConnection: Keep-Alive\r\nContent-Type: text/plain\r\nContent-Length:000000010240\r\n\r\n",
  "callback_url":"http://172.22.113.49:5000/post/http"
  }
  --${bound}
  Content-Disposition: form-data; name="request"; filename="httpbody"
  Content-Type: application/octet-stream
  %HTTP BODY%

  HTTP BODY 格式：

  Film and the City: The Urban Imaginary in Canadian Cinema.

• 异步状态：

  POST /skg/v1/dlp/channel/web/http/async
  Content-Type: multipart/form-data; boundary=${bound}
  --${bound}
  Content-Disposition: form-data; name="metadata"
  Content-Type: application/json
  {
  "sourceAddress":"123.12.12.112",
  "user":"abc\enduser1",
  "url":"http://www.sina.com.cn/forum/post.action",
  "httpBodyLen" : 10240,
  "queryID" : "1024f306-566a-415f-9ada-1be89b9f1086",
  "sendBack": {
          "type": "s3",
          "s3Bucket": "test",
          "s3Region": "", # 将脱敏后的文件上传到该位置。此处的值为使用s3时的region name，
  # 如果运行在EC2上并使用AWS IAM role，则以下三项可省略，则以下三项accessKey、secretKey、endpointUrl可省略
          "accessKey": "aws_accessKey",
          "secretKey": "aws_secretKey",
          "endpointUrl": ""
    },
  "redaction": {
          "enable": true # 当enable的值为true时，该请求才生效
    }
  "httpHeader":"Host: testhost.com\r\nConnection: Keep-Alive\r\nContent-Type: text/plain\r\nContent-Length:000000010240\r\n\r\n",
  "uploadtype":"file/s3",
  "callback_url":"http://172.22.113.49:5000/post/http"
  }
  --${bound}
  Content-Disposition: form-data; name="request"; filename="http://s3_url/httpchannel/http/http.txt"
  Content-Type: application/octet-stream
  %HTTP BODY%

Python请求示例 - HTTP通道 （同步模式）

以下示例为使用Python代码调用接口，以在同步模式下，发送HTTP通道中的文件供内容安全审查。

# -*- coding: utf-8 -*-
from requests.packages.urllib3.exceptions import InsecureRequestWarning
from ucwi_config import UCWIConfig
from ucwi_auth import get_headers
import requests
import json
import os
import uuid

requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

# protocol value: "http" "https"
protocol = "http"
api = "/skg/v1/dlp/channel/web/{}/sync".format(protocol)
url = "{0}{1}".format(UCWIConfig.base_url, api)
file_path = "test.txt"

metadata = {
    "user": "ucwitestuser",
    # 发送数据的用户，用于内容安全审查时的策略匹配，以及内容安全审查完成后的事件显示
    "sourceAddress": "172.22.1.1",
    # 数据的源IP地址, 用于内容安全审查时的策略匹配，以及内容安全审查完成后的事件显示
    "httpBodyLen": str(os.path.getsize(file_path)),
    # 发送的HTTP包正文的大小,用于内容安全审查时的策略匹配
    "queryID": str(uuid.uuid4()),
    # 此次请求关联的UUID，需要唯一，在异步模式下，用于事件查询
    "httpHeader": "Host: 127.0.0.1\r\nConnection: Keep-Alive\r\nContent-Type: text/plain\r\nContent-Length: 10240\r\n\r\n",
    # 用户发送的HTTP包的Header，即数据包头信息
    "url": "http://172.16.0.1/post.php",
    # HTTP请求的URL地址
}

headers = get_headers()
data = {"metadata": json.dumps(metadata)}
fd = open(file_path)
files = {
    "request": fd
}
response = requests.post(url, headers=headers, data=data, files=files, verify=False)
fd.close()

if response.status_code != 200:
    print("Bad request, response code:", response.status_code)
    print(response.text)
else:
    result = response.json()
    # print(json.dumps(result, indent=4).decode('raw_unicode_escape'))
    if result["responseCode"] != 200:
        print("Bad request, response code:", result["responseCode"])
        print(result["message"])
    else:
        hint = "# 1:允许； 2：阻断；3：确认；4：删除附件；5：邮件加密；6：邮件隔离；7：终端系统加密；8：邮件内容加密；9：终端个人密钥加密"
        print("action:{}    {}".format(result["actionCode"], hint))
        if len(result["incident_info"]) == 0:
            print("not matched.")
        else:
            print(result)
            print("matched policy:")
            for policy in result["incident_info"]["matchedPolicies"]:
                print(json.dumps(policy, indent=2).encode('utf-8').decode('raw_unicode_escape'))

Python请求示例 - HTTP通道（异步模式）

以下示例为使用Python代码调用接口，以在异步模式下，发送HTTP通道中的文件供内容安全审查。

# -*- coding: utf-8 -*-
from requests.packages.urllib3.exceptions import InsecureRequestWarning
from ucwi_config import UCWIConfig
from ucwi_auth import get_headers
import requests
import json
import uuid
import os

requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

# protocol value: "http" "https"
protocol = "http"
api = "/skg/v1/dlp/channel/web/{}/async".format(protocol)
url = "{0}{1}".format(UCWIConfig.base_url, api)
file_path = "test.txt"

metadata = {
    "user": "ucwitestuser",
    # 发送数据的用户，用于内容安全审查时的策略匹配，以及内容安全审查完成后的事件显示
    "sourceAddress": "172.22.1.1",
    # 数据的源IP地址, 用于内容安全审查时的策略匹配，以及内容安全审查完成后的事件显示
    "httpBodyLen": str(os.path.getsize(file_path)),
    # 发送的HTTP包正文的大小,用于内容安全审查时的策略匹配
    "queryID": str(uuid.uuid4()),
    # 此次请求关联的UUID，需要唯一，在异步模式下，用于事件查询
    "httpHeader": "Host: 127.0.0.1\r\nConnection: Keep-Alive\r\nContent-Type: text/plain\r\nContent-Length: 10240\r\n\r\n",
    # 用户发送的HTTP包的Header，即数据包头信息
    "url": "http://172.16.0.1/post.php",
    # HTTP请求的URL地址
    "uploadtype": "file",
    "callback_url": UCWIConfig.callback_url + "/web"
}

headers = get_headers()
data = {"metadata": json.dumps(metadata)}
fd = open(file_path)
files = {
    "request": fd
}
response = requests.post(url, headers=headers, data=data, files=files, verify=False)
fd.close()

if response.status_code != 200:
    print("Bad request, response code:", response.status_code)
    print(response.text)
else:
    result = response.json()
    print(result["message"])

Java请求示例 - HTTP通道 （同步模式）

以下示例为使用Java代码调用接口，以在同步模式下，发送HTTP通道中的文件供内容安全审查。

import java.util.HashMap;
import java.util.Iterator;
import java.util.Properties;
import java.util.UUID;
import java.io.File;
import java.io.FileInputStream;
 
import javax.net.ssl.SSLContext;
import java.security.cert.X509Certificate;
 
import com.alibaba.fastjson.JSONObject;
import org.apache.http.HttpEntity;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.ssl.SSLContextBuilder;
import org.apache.http.conn.ssl.TrustStrategy;
import org.apache.http.conn.ssl.TrustSelfSignedStrategy;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.conn.ssl.NoopHostnameVerifier;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.entity.ContentType;
import org.apache.http.entity.mime.MultipartEntityBuilder;
import org.apache.http.entity.mime.content.FileBody;
import org.apache.http.entity.mime.content.StringBody;
import org.apache.http.util.EntityUtils;
 
public class TestHttp {
 
    public static String inspectHttpFile(File file) {
 
        String host = "<UCWI_HOST>";
        String port = "<UCWI_PORT>";
        String apiPath = "/skg/v1/dlp/channel/web/http/sync";
        String url = "https://" + host + ":" + port + apiPath;
 
        String queryId = UUID.randomUUID().toString();
 
        JSONObject metadataJson = new JSONObject();
        metadataJson.put("user", "cloudtest\\httpuser");
        metadataJson.put("sourceAddress", "172.22.117.242");
        metadataJson.put("httpBodyLen", "987111");
        metadataJson.put("queryID", queryId);
        metadataJson.put("httpHeader", "Host: testhost.com");
        metadataJson.put("url", "http://172.16.0.1/post.php");
 
        HttpPost post = new HttpPost(url);
 
        post.addHeader("Authorization", "<Authorization>");
        post.addHeader("x-skg-timestamp", "<timestamp>");
 
        CloseableHttpClient client = HttpClients.createDefault();
        try {
            SSLContext sslContext = new SSLContextBuilder().loadTrustMaterial(null, new TrustStrategy() {
                public boolean isTrusted(X509Certificate[] chain, String authType) {
                    return true;
                }
            }).build();
            SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslContext, new NoopHostnameVerifier());
            client = HttpClients.custom().setSSLSocketFactory(sslsf).build();
        }
        catch (Exception e){
            e.printStackTrace();
        }
 
        String metadataString = metadataJson.toJSONString();
 
        MultipartEntityBuilder builder = MultipartEntityBuilder.create();
        StringBody metadataPart = new StringBody(metadataString, ContentType.TEXT_PLAIN);
        builder.addPart("metadata", metadataPart);
 
        FileBody filePart = new FileBody(file);
        builder.addPart("request", filePart);
 
        HttpEntity multipart = builder.build();
        post.setEntity(multipart);
        String result = "";
        try {
            CloseableHttpResponse resp = client.execute(post);
            HttpEntity entity = resp.getEntity();
            result = EntityUtils.toString(entity, "UTF-8");
        }
        catch (Exception e){
            e.printStackTrace();
        }
 
        return result;
    }
 
    public static void main(String []args) {
        String filepath = "/tmp/file1";
        File f = new File(filepath);
        String result = inspectHttpFile(f);
        System.out.println(result);
    }
}

cURL请求示例 - HTTP通道 （异步模式）

按照如下示例使用cURL调用接口在Web通道中进行内容审查。

返回参数

内容审查请求返回结果中包含以下参数：

返回示例

内容审查请求的回复如下。

• 请求成功：

  {
  "result" : 0,
  "actionCode" : 1/2
  }
  actionCode: 1 - allow, 2 - block

  注： 若匹配策略，发现违规内容，系统还将返回策略匹配信息，具体请参照送检策略匹配返回值定义
• 请求失败：

  {
  "result" : 1,
  "errorCode" : 500,
  "message" : "Invalid parameter"
  }

错误代码