Method detect

class/projectModel/safecloudModel.py:424–496

检测文件是否为木马 @time: 2025-02-19 @param file_path: 文件路径 @return: 是否可疑, 规则名称

(self, file_path: str)

        return True

    def detect(self, file_path: str) -> tuple:
        """检测文件是否为木马
        @time: 2025-02-19
        @param file_path: 文件路径
        @return: <tuple> 是否可疑, 规则名称
        """
        try:
            # 基础检查
            if not os.path.exists(file_path) or not os.path.isfile(file_path):
                return False, ''

            # 检查文件大小
            file_size = os.path.getsize(file_path)
            if file_size < 1024:  # 小于1KB，视为空文件
                return False, ''
            if file_size > 10 * 1024 * 1024:  # 10MB限制
                return False, ''

            # 频率限制检查
            if not self._check_rate_limit():
                logging.warning("Cloud detection rate limit exceeded for: {}".format(file_path))
                return False, ''

            # 确保有可用的检测URL
            if not self._update_check_url():
                return False, ''

            # 读取文件内容
            file_content = self.ReadFile(file_path)
            if not file_content:
                return False, ''

            # 计算文件MD5
            md5_hash = self.FileMd5(file_path)
            if not md5_hash:
                return False, ''

            # 发送检测请求
            try:
                upload_data = {
                    'inputfile': file_content,
                    'md5': md5_hash
                }
                response = requests.post(self.check_url, upload_data, timeout=20)
                # 添加响应内容检查
                if not response.content:
                    # logging.error("Empty response from cloud detection for file: {}".format(file_path))
                    return False, ''
                try:
                    result = response.json()
                except json.JSONDecodeError as je:
                    # logging.error("Invalid JSON response from cloud detection for {}: {}".format(file_path, response.content))
                    return False, ''

                # 查看是否需要告警
                if isinstance(result, dict) and result.get('msg') == 'ok':
                    try:
                        is_webshell = result.get('data', {}).get('data', {}).get('level') == 5