߲j! fUdZddlZddlmZddlmZddlmZddl m Z ddl m Z ded efd Zd ed efd Zej$d ej&Zded eefdZded eefdZej$dej.dfej$dej.dfej$dej.dfej$dej.dfej$dej.dfej$dej.dfej$dej.dfej$dej.ej0zd fej$d!ej.ej0zd ff Zeeej6eefd"fed#<ej$d$ej0Zd%Zeeeefd"fed&<d'ed efd(Zd efd)Z d efd*Z!d+ed efd,Z"ded e#efd-Z$ded eefd.Z%ded eefd/Z&ded eefd0Z'd1ed2ed eefd3Z(y)4ubrowser_console(expression=...) policy: SSRF guard gating, private-URL probes, and the opt-in sensitive-primitive denylist. Facade-owned state is read through ``_bt`` (``tools.browser_tool``, resolved per call) — no import cycle. N)Optionalis_truthy_value) origin_module)browser_tool_cloud)browser_tool_sessioneffective_task_idreturnct}tj xr)|j| xrtj S)awReturn True when eval-driven private-network access must be guarded. Same gating as ``browser_navigate`` / ``browser_snapshot`` / ``browser_vision``: the SSRF guard only matters for non-local backends (cloud browser, or a containerized terminal whose browser-on-host reaches networks the terminal can't); skipped for local sidecars / ``allow_private_urls``. )_origin_cloud_is_local_backend_is_local_sidecar_key_allow_private_urls)r _bts C/home/ubuntu/.hermes/hermes-agent/tools/browser_tool_eval_policy.py_eval_ssrf_guard_activers\ )C'') ) D#2K2KL]2^.^ DgmhBhBhDdDDurlcL|j|xs|j| S)zWTrue when ``url`` hits the always-blocked cloud-metadata floor or fails the SSRF guard.)_is_always_blocked_url _is_safe_url)rrs r _url_blockedrs&  % %c * G#2B2B32G.GGrzhttps?://[^\s'"`)\]<>]+ expressionctt|trtj |ng}t fdd|DDdS)zkReturn the first private/always-blocked ``http(s)://`` literal in a JS expression (best-effort), else None.c3<K|]}t|s|ywN)r).0crs r z2_expression_targets_private_url..)sXqK|]}|jdyw)z.,;N)rstrip)rms rr z2_expression_targets_private_url..)s?QXXe_?sN)r isinstancestr_JS_URL_LITERAL_REfindallnext)rliteralsrs @r_expression_targets_private_urlr*%sB )C9CJPS9T!))*5Z\H X?h?XZ^ __rct} tj|ddgdd}|jdr^|jdijdd j j d j d }|rt ||r|Sy #t $r&}|jjd |Yd }~y d }~wwxYw)zReturn the current page URL when it targets a private/internal address (e.g. after a prior ``location.href = '...'`` eval). Fail-open on probe failure, matching the snapshot/vision guards.evalwindow.location.hrefauto)timeout_engine_overridesuccessdataresult"'z,_current_page_private_url: probe failed (%s)N) r _session_run_browser_commandgetstripr Exceptionloggerdebug)r r url_result current_urlexcs r_current_page_private_urlrB,s )CN223DfOeNfpqEKL >>) $$..4882FLLNTTUXY__`cdK|C=""  N GMM NsB B C CCz\bdocument\s*\.\s*cookie\bdocument.cookiez#\b(?:localStorage|sessionStorage)\b web storagez \bindexedDB\b IndexedDBz%\bcaches\s*\.\s*(?:open|match|keys)\b Cache Storagez<\bnavigator\s*\.\s*(?:clipboard|credentials|serviceWorker)\bnavigator sensitive APIz5\b(?:fetch|XMLHttpRequest|WebSocket|EventSource)\s*\(network requestz"\bnavigator\s*\.\s*sendBeacon\s*\(network beaconz$\bdocument\s*\.\s*forms\b.*\bvalue\bzform value extractionzN\bquerySelector(?:All)?\s*\([^)]*(?:input|textarea|password)[^)]*\).*\bvalue\b._RISKY_BROWSER_EVAL_PATTERNSz8'(?:\\.|[^'\\])*'|\"(?:\\.|[^\"\\])*\"|`(?:\\.|[^`\\])*`) )cookierC) localStoragerD)sessionStoragerD) indexedDBrE)cachesrF) clipboardrG) credentialsrG) serviceWorkerrG)fetchrH)XMLHttpRequestrH) WebSocketrH) EventSourcerH) sendBeaconrI_SENSITIVE_BROWSER_EVAL_TOKENSkeycHt}|j|ddd|dS)zRRead boolean ``browser.`` (default False) through the origin's config reader.Fct|dS)NF)defaultr)vs rz$_browser_eval_flag..Ys /!U2Srzbrowser.z from config)r _browser_cfg)rYrs r_browser_eval_flagr`Vs. )C   C(SW_`c_ddpUq rrrctdS)z`Whether sensitive browser JS evaluation is explicitly allowed (overrides ``restrict_evaluate``).allow_unsafe_evaluater`rr_allow_unsafe_browser_evaluatere\s 5 66rctdS)aWhether the sensitive-primitive eval denylist is enabled (off by default). It blocks the *names* of common primitives (``fetch``, ``cookie``, ``querySelector(...input...)``), not actual exfiltration, so it also blocks much legitimate DOM extraction; egress is still gated by the SSRF/private-URL guards in ``_browser_eval`` regardless. Opt in via ``browser.restrict_evaluate: true`` (e.g. hostile pages with a logged-in profile). restrict_evaluatercrdrr_restrict_browser_evaluaterhas 1 22rliteralct|dkr|S t|dddjdS#t$r|ddcYSwxYw)zbBest-effort decode of a JS string literal (not a parser): normalizes escapes like ``"co\x6fkie"``.zutf-8unicode_escape)lenbytesdecoder<)ris r_decode_js_string_literalrrlsR 7|aWQr]G,334DEE q}s0AActj|Dcgc]}t|jdc}Scc}w)Nr)_JS_STRING_LITERAL_REfinditerrrgroup)rmatchs r_decoded_js_string_literalsrxvs0CXCaCablCm n% %ekk!n 5 nn ns!<cdjtjtfdtDdS)zRisk reason for direct or quoted sensitive primitives: direct spellings alone miss ``document["cookie"]`` / ``globalThis["fetch"]``, so tokens are also matched inside the decoded, concatenated string literals (catches ``document["coo" + "kie"]``).r5c3K|]W\}}tjdtj|dtjs|j vr|Yyw)z\bN)researchescapeIlower)rtokenreasonrr)s rr z7_sensitive_browser_eval_token_reason..sSjME6IIBIIe$4#5R8*bddKu{{}`hOhjsAA N)joinrxrr(rX)rr)s`@r$_sensitive_browser_eval_token_reasonrzsCww2:>?EEGH j-Kjko qqrcZsytfdtDd}|xs tS)zHReturn a human-readable reason if a JS expression uses risky primitives.Nc3LK|]\}}|js|ywr)r|)rpatternrrs rr z-_risky_browser_eval_reason..s!i?7Fgnn]gNhis$$)r(rJr)rhits` r_risky_browser_eval_reasonrs.  i.Jiko pC  B6zBBrcTtr tryt|}|syd|dS)zBlock sensitive browser JS evaluation when the opt-in denylist is on (opt-in because it gates on primitive *names*; private-address egress is enforced separately in ``_browser_eval``).Nz^Blocked: browser_console(expression=...) tried to use sensitive browser JavaScript primitive (z) while browser.restrict_evaluate is enabled. Use browser_snapshot/browser_get_images/browser_console without expression for normal inspection, or set browser.restrict_evaluate: false in config.yaml to allow programmatic evaluation.)rhrer)rrs r_enforce_browser_eval_policyrs? & '+I+K ' 3F  %%+H-` `artab_iduser_idct} ddlm}|d|dd|d}tt |t r|j dn|xsd }|jjd jd }|rt||r|Sy #t$r&}|jjd |Yd }~y d }~wwxYw)uCamofox analogue of ``_current_page_private_url`` (evaluate endpoint instead of the CLI). Fail-open on probe failure, matching the snapshot/vision guards — do not make fail-closed without the sibling.r)_postz/tabs/z /evaluater-)ruserId)bodyr4r5r6r7z4_camofox_current_page_private_url: probe failed (%s)N) r tools.browser_camofoxrr%r$dictr:r;rr<r=r>)rrrrr3r@rAs r!_camofox_current_page_private_urlrs )CV/vfXY/E[gn6op 40F$((8,DJTVW !'')//4::3? <[9   V OQTUU VsBB CB<<C))__doc__r{typingrutilsrtools.browser_tool_originrr toolsrr rr8r%boolrrcompile IGNORECASEr&r*rBr~SrJtuplePattern__annotations__rtrXr`rerhrrlistrxrrrrrdrrrs  !>.2DsDtDH3H4H RZZ > N`` `  #  RZZ-rtt46GHRZZ6=}MRZZ "$$'5RZZ8"$$?QRZZOQSQUQUVXqrRZZH"$$OQbcRZZ5rtt<>NORZZ7EG^_RZZacecgcgjljnjncnorIJ IeE"**S/3*>$?$DE # #bdfdhdhi ?eCHos&: ; sCsDs 77 3D3ssoCoDIoqSqXc]qC3C8C=C aS aXc] a c C HSM r