߲jK(UdZddlmZddlZddlZddlZddlZddlZddlZ ddl Z ddl m Z m Z ddlmZddlmZddlmZej(eZedd hZd d d Zd ZddZd dZGdde j:j<ZGdde j:j@Z!da"de#d<d!dZ$d"dZ%d#dZ&d$dZ'ddd%dZ(ddd d&dZ)gdZ*y)'z>Security policy for credential-bearing stdlib urllib requests.) annotationsN)CallableIterable)Path)Any)file_signatureacceptz user-agentPi)httphttps)HERMES_CA_BUNDLE SSL_CERT_FILEREQUESTS_CA_BUNDLECURL_CA_BUNDLEc$tjj|}|jxsdj }|j }||j xsdj jd||fStj|fS)z>Return a normalized (scheme, hostname, effective port) origin..) urllibparseurlparseschemelowerporthostnamerstrip_DEFAULT_PORTSget)urlparsedrrs ?/home/ubuntu/.hermes/hermes-agent/hermes_cli/urllib_security.py url_originr!s| \\ " "3 'Fmm!r ( ( *F ;;D FOO)r00299#>HX xx^l^p^pqw^x xxct|jD])\}}|j|vs|j|+y)zFDrop every header on *request* whose lowercased name is not in *keep*.N)list header_itemsr remove_header)requestkeepname_values r _strip_headersr+%s?W1134( f ::z9SafeCredentialRedirectHandler.__init__..3s3l$CIOO4E3ls#%)r!_original_origin frozenset_cross_origin_safe_headers)self original_urlr.s r __init__z&SafeCredentialRedirectHandler.__init__/s%!+< 8*33lRk3l*l'r"ct|||||||}|yttjj |j ||jk7rt||j|Sr1) superredirect_requestr!rrurljoinfull_urlr5r+r7) r8reqfpcodemsgheadersnewurl redirected __class__s r r=z.SafeCredentialRedirectHandler.redirect_request5seW-c2tS'6R   fll**3<<@ ATEZEZ Z :t'F'F Gr")r9r2r.z Iterable[str]returnNone)__name__ __module__ __qualname____doc___CROSS_ORIGIN_SAFE_HEADERSr:r= __classcell__)rGs@r r-r-,s8KPjmm?Lm m  r"r-c8eZdZdZedZddZddZeZeZ y)_CrossOriginRequestSanitizerz:Strip headers after installed request processors have run.infc$t||_yr1)r!r5)r8r9s r r:z%_CrossOriginRequestSanitizer.__init__Ks *< 8r"cjt|j|jk7rt|t|Sr1)r!r?r5r+rN)r8r's r _sanitizez&_CrossOriginRequestSanitizer._sanitizeNs+ g&& '4+@+@ @ 7$> ?r"N)r9r2rHrI)r'urllib.request.Request) rJrKrLrMfloat handler_orderr:rU http_request https_requestr"r rQrQBs&D %LM9 LMr"rQz#tuple[tuple, ssl.SSLContext] | None_HTTPS_CONTEXT_CACHEcg}tfdtDd}|rZt|j}|j r|j t |ntjd|tjdk(r/ ddl }|j |jt|St|S#t$r*}tjd|Yd}~t|Sd}~wwxYw)u6Bundles to try in order; empty keeps the stdlib default. Resolving the candidates and loading them are split so the memo below can key on the files that are actually going to be read — one precedence rule, not one for the loader and a second for the cache key that could drift away from it. c3pK|]-}tj|djxs*/yw)rN)osgetenvstrip)r3r)values r r4z(_ca_bundle_candidates..fs1fSWY[I\IbIbId@d@defs+66ruJCA bundle path does not exist: %s — falling back to default certificatesdarwinrNuaCould not load certifi for urllib HTTPS verification: %s — falling back to default certificates)next_CA_BUNDLE_ENV_VARSr expanduseris_fileappendr2loggerwarningsysplatformcertifiwhere ImportErrortuple) candidates ca_bundleca_pathrmexcrbs @r _ca_bundle_candidatesru^sJf(;fhjkIy/,,. ??    c'l + NNgir s ||x     gmmo .  5    NNs      s #C C9C44C9cv |gtt|jS#t$r|dfcYSwxYw)u%``(path, *file_signature(stat))`` so an edited or rotated bundle invalidates the memo. ``utils.file_signature`` adds inode and ctime to mtime + size, so a timestamp-preserving replacement (``cp -p``, ``rsync -t``) of the bundle is caught as well. Unreadable → ``(path, None)``. N)rrstatOSError)paths r _bundle_signaturerz}s> 9~d4joo&7899 d|s %( 88ct}|syt|d}t}| |d|k(r|dSt|\}}||dk(r||fa|S)uReturn the shared explicit-CA context for Hermes-owned urllib openers. Memoised on the preferred bundle's signature only: that is the one file a memoised context was built from, so a change to a fallback bundle (certifi on macOS) that was never read must not invalidate it — and costs no stat per request. The returned context is shared and must not be mutated by callers. Nr)rurzr\_build_https_context)rqkeycachedcontext used_paths r _resolved_https_contextrsl'(J  JqM *C !F fQi3.ay-j9GYJqM! !$W~ Nr"c|D]} tj||fcS|rtj dy#ttjf$r!}tj d||Yd}~ld}~wwxYw)zQReturn ``(context, path)`` for the first loadable candidate, or ``(None, None)``.)cafileuDCA bundle could not be loaded from %s: %s — trying the next bundleNuPNo configured CA bundle could be loaded — falling back to default certificates)NN)sslcreate_default_contextrxSSLErrorrirj)rqryrts r r}r}swn n--T:D@ @n ij  & n NNacgil m m ns:A4A//A4 ssl_contextcttjdd}|It}tjj|gn tjj |g}ttjdd}|duxr|du}t|ddDcgc]I}t |tjjs#|r t ||stj|K}}|r|j|||jt||jt|tjj|}tt|dd|_ g|_|Scc}w)a_Clone the installed opener's handlers, replacing redirect policy only. ``ssl_context`` rebinds the cloned HTTPS handler so per-provider TLS settings (``ssl_ca_cert``/``ssl_verify``) apply; with None a Hermes-owned opener gets the explicit CA default from ``_resolved_https_context`` and an application-installed opener keeps its TLS. _openerN)r HTTPSHandlerhandlersr[ addheaders)getattrrr'r build_openerr isinstanceHTTPRedirectHandlercopyrhr-rQr$_hermes_initial_addheadersr) r9r installedr_https_handler_cls replace_httpshandlerrsecureds r $_secure_opener_from_installed_policyrsG 48I)+NN//"fnnNiNiryNiNzM{}  Ft+N0B$0NMy*b9 '6>>#E#EF:g7I#J 'H *;?@ OO1,?@ OO0>?nn))84G*.gir.R)SG&G NsAE9)opener_factoryrc|Qt|j|}t|ddD])\}}|j|r|j ||+n|t |j}|j ||S)a`Open a request without forwarding credentials across origins. Preserves an application-installed opener's proxy/TLS/cookies/handlers while replacing its redirect handler. ``opener_factory`` is an explicit test seam (security is never disabled based on global ``urlopen`` identity); ``ssl_context`` overrides TLS for this request only. rrr[)timeout)rr?r has_header add_headerr-open)r'rrropenerr)rbs r open_credentialed_urlrs5g6F6FT_`"6+GL 0KD%%%d+""4/ 0 =g>N>N OP ;;w; 00r")r-rr!)rr2rHztuple[str, str, int | None])r(zfrozenset[str]rHrI)rHtuple[str, ...])ryr2rHrp)rHzssl.SSLContext | None)rqrrHz(tuple[ssl.SSLContext | None, str | None])r9r2)r'rVrrWrzCallable[..., Any] | None)+rM __future__rrloggingr_rrk urllib.parserurllib.requestcollections.abcrrpathlibrtypingrutilsr getLoggerrJrir6rNrrer!r+r'rr- BaseHandlerrQr\__annotations__rurzrr}rr__all__r[r"r rsD"  .   8 $','?@s+cy(FNN$F$F,6>>#=#=2=A9@> 6 LPH15 1 #11. 1. Sr"