`gjdZddlmZddlZddlZddlZddlmZm Z ddl m Z e ddhZ dd d Zdd ZGd d ej j"ZGddej j&ZddZdd ddZgdZy)z>Security policy for credential-bearing stdlib urllib requests.) annotationsN)CallableIterable)Anyacceptz user-agentPi)httphttpsc$tjj|}|jxsdj }|j }||j xsdj jd||fStj|fS)z>Return a normalized (scheme, hostname, effective port) origin..) urllibparseurlparseschemelowerporthostnamerstrip_DEFAULT_PORTSget)urlparsedrrs M/root/.hermes/venv/lib/python3.12/site-packages/hermes_cli/urllib_security.py url_originrs \\ " "3 'Fmm!r ( ( *F ;;D  B%%'..s3  '5&8&8&@ c:eZdZdZed ddZfdZxZS)SafeCredentialRedirectHandlerzAPreserve request headers only while redirects stay on one origin.)cross_origin_safe_headerscRt||_td|D|_y)Nc3NK|]}t|jywN)strr).0names r z9SafeCredentialRedirectHandler.__init__..)s 4 "&CIOO 4 s#%)r_original_origin frozenset_cross_origin_safe_headers)self original_urlrs r__init__z&SafeCredentialRedirectHandler.__init__"s+ !+< 8*34 *C4 + 'rcXt |||||||}|ytjj |j |}t ||jk7rOt|jD]3\} } | j|jvs#|j| 5|Sr") superredirect_requestrrurljoinfull_urlrr'list header_itemsrr) remove_header) r*reqfpcodemsgheadersnewurl redirected resolved_urlr%_value __class__s rr/z.SafeCredentialRedirectHandler.redirect_request-sW-c2tS'6R  ||++CLL&A l #t'<'< <!%Z%<%<%> ? 3 f::s@rrrs7K 4N    $1      rrc8eZdZdZedZddZddZeZeZ y)_CrossOriginRequestSanitizerz:Strip headers after installed request processors have run.infc$t||_yr")rr')r*r+s rr,z%_CrossOriginRequestSanitizer.__init__Hs *< 8rct|j|jk7rIt|j D]-\}}|j t vs|j|/|Sr")rr1r'r2r3rrEr4)r*requestr%r=s r _sanitizez&_CrossOriginRequestSanitizer._sanitizeKs` g&& '4+@+@ @ $W%9%9%; < 0 f::<'AA))$/ 0rN)r+r#r?r@)rLurllib.request.Request) rArBrCrDfloat handler_orderr,rM http_request https_requestrrrHrH=s&D%LM9LMrrHc ttjdd}|tjj}t|ddDcgc];}t |tjj st j |=}}|jt||jt|tjj|}t|dtt|ddg|_ |Scc}w)zFClone the installed opener's handlers, replacing redirect policy only._openerNhandlersrS_hermes_initial_addheaders addheaders) getattrrrL build_opener isinstanceHTTPRedirectHandlercopyappendrrHsetattrr2rX)r+ installedhandlerrVsecureds r$_secure_opener_from_installed_policyrcVs 48INN//1 y*b9 '6>>#E#EF 'H  OO1,?@ OO0>?nn))84G $ WY b 12 G N#s AD)opener_factoryc|Ot|j}t|ddD])\}}|j|r|j ||+n|t |j}|j ||S)abOpen a request without forwarding credentials across origins. The default preserves an application-installed opener's proxy, TLS, cookies, custom protocol handlers, and instrumentation while replacing its redirect handler. ``opener_factory`` is an explicit test seam; security is never disabled based on global ``urlopen`` identity. rWrS)timeout)rcr1rY has_header add_headerropen)rLrfrdopenerr%values ropen_credentialed_urlrlps5g6F6FG"6+GL 0KD%%%d+""4/ 0 =g>N>N OP ;;w; 00r)rrlr)rr#r?ztuple[str, str, int | None])r+r#)rLrNrfrOrdzCallable[..., Any] | None)rD __future__rr] urllib.parserurllib.requestcollections.abcrrtypingrr(rErrrLr\r BaseHandlerrHrcrl__all__rSrrrtsD" .','?@s+ FNN$F$F<6>>#=#=2<15 1 #11. 1. r