+ lHjo Rt^RIt^RIt^RIt^RIt^RIt^RIt^RIHt^RI H t H t ^RI H t HtHtHtHtHtHt^RIHt^RIHt]P0!]4tRVt]!RR04t]P<]P>,t R R lt!R R lt"]!0RWm4t#R Rlt$]!RR04t%RXt&]!]&Uu0uFp]POV4kK up]&Uu0uFp]PORV,4kK up,]PN!R40,4t(]);QJd.RRY4FNK 5M !RRY44t*]!R04t+^t,]PZ!R4t.]PZ!R4t/]);QJd.RRZ4FNK 5M !RRZ44t0RRus1s2RR[us3s4RRlt5RRlt6RRlt7RR lt8R!R"lt9R#R$lt:R%R&lt;R'R(ltR-R.lt?R/R0lt@R1R2ltAR3R4ltBR5R6ltCR7R8ltDR9R:ltER;R<ltF!R=R>]G4tHR?R@ltI!RARB4tJ!RCRD]J4tK!RERF]J4tLRGRHltM]RIRJl4tNRKR/RLRMlltORKR/RNROlltPRPRQltQRRRSltRRTRUltSR#uupiuupi)]uWURL safety checks — blocks requests to private/internal network addresses (SSRF). ``security.allow_private_urls: true`` disables private-IP blocking (DNS that resolves public names to private ranges); cloud metadata hostnames/IPs are **always** blocked. A local TUN proxy that answers DNS with a fake-ip block (Mihomo/Clash fake-ip, Surge enhanced) declares that block in ``security.fake_ip_ranges`` so its sentinel answers are dialable instead of looking private; the list is empty by default, so the sentinel stays blocked for everyone else. DNS rebinding (TOCTOU) is closed for Hermes-owned httpx paths by ``create_ssrf_safe_[async_]client()``, which re-apply the policy at TCP connect and dial the validated IP while preserving Host/SNI. Redirect bypass is mitigated by response hooks re-validating each target (``redirect_target_from_response``). N)contextmanager)AnyOptional) parse_qslquoteunquoteurljoinurlparseurlsplit urlunsplit)get_hermes_home_override)is_truthy_valuehttphttpsc$V^8dQhR\/#returnbool)formats"5/home/ubuntu/.hermes/hermes-agent/tools/url_safety.py __annotate__r"s;;d;cz\;QJd R\4F 'gK R# R#!R\44#)c3`"TF$p\PPV4xK& R#5iN)osenvironget).0vs& r '_proxy_is_configured..#s :/Qrzz~~a  /s,.TF)any_PROXY_ENV_VARSrr_proxy_is_configuredr'"s+ 3:/:33:3:3:/: ::rc0V^8dQhR\R\/#rurlr)str)rs"rrr&sgg3g3grc \V\4'gV#VP4pV'gV#\P!RRV4p\ V4pTPP4\9dT#TPTPrCT'd:TPR4PR4pYT8wdTPYE^4pRp\!TPT\#TP$TR7\#TP&TR,R7\#TP(TR,R734# \ dTu#i;i \dTpLi;i)uASCII-safe HTTP URL for Hermes-owned URL tools (IRI -> URI, e.g. ``https://wttr.in/Köln``). Preserves URL syntax and existing percent escapes while IDNA-encoding the host and percent-encoding non-ASCII path/query/fragment text. URL tool inputs only — never shell commands.z ^([A-Za-z][A-Za-z0-9+.-]*://)\s+z\1idnaasciiz/%:@!$&'()*+,;=)safe?) isinstancer+stripresubr ValueErrorschemelower _HTTP_SCHEMESnetlochostnameencodedecode UnicodeErrorreplacer rpathqueryfragment)r*rawparsedr9r: ascii_hostr/s& rnormalize_url_for_requestrE&s0 c3   ))+C   &&4eS AC#}}M1 }}fooH "!077@J  !^^H!.\s:T'V%cl0026RR'Vs AA AT)keep_blank_values) r1r+r r2r5r6r7r8r@nextr)r*rCs& rsensitive_query_param_namerOPs c3  3c>#))+&}}M1 TyQU'VTUY [[ sB B('B(zmetadata.google.internalz metadata.googz::ffff:z fd00:ec2::254c#N"TFp\P!V4xK R#5ir ipaddress ip_networkr ns& rr"r"qs oBnQ!5!5a!8!8Bn#%zmultimedia.nt.qq.com.cn 100.64.0.0/10z::ffff:0:0:0/96c#N"TFp\P!V4xK R#5irrQrTs& rr"r"s('I1y';';A'>'>IrVFc$V^8dQhR\/#rr)rs"rrrs ! !D !rcl\4e \4#\'gR\4uss\#)uTrue when the user has opted out of private-IP blocking. Priority: ``HERMES_ALLOW_PRIVATE_URLS`` env, ``security.allow_private_urls``, legacy ``browser.allow_private_urls``. Profile-scoped turns (``get_hermes_home_override()`` set) bypass the process-global cache — a multiplex gateway serves several profiles in one process; the first profile's opt-out must not disable blocking for later ones.T)r _resolve_allow_private_urls_allow_private_resolved_cached_allow_privater&rr_global_allow_private_urlsr^s4  !-*,, " "9=?Z?\6!6  rc$V^8dQhR\/#rr)rs"rrrsTrc\P!RR4P4P4pVR9dR#VR 9dR#^RIHpV!4pR FRpVP V/4p\V\4'gK-\VP R4RR7'gKQR# R# \dR#i;i) zFResolve the effective private-URL toggle from the active config scope.HERMES_ALLOW_PRIVATE_URLSTFread_raw_configallow_private_urls)default>1yestrue>0nofalse)securitybrowser) rgetenvr2r7hermes_cli.configrdrr1dictr Exception)env_valrdcfgsectionblocks rr[r[sii3R8>>@FFHG&&&& 5.GGGGR(E%&&?599EY;Zdi+j+j/     s$7B.B.'B.*B.. B=<B=cV^8dQhRR/#)rrNr&)rs"rrrs  D rcR;s;ssRsR#)uIReset the cached toggle and the cached fake-ip ranges — only for tests.FNr&)r\r]_fake_ip_resolved_cached_fake_ip_rangesr&rr_reset_allow_private_cacher{sKPOO36Grc$V^8dQhR\/#rtuple)rs"rrrsrca^RIHpV!4PR/4p\V\4'dVPR4MRp\T\ 4'dT.M\T\\34'dTMR p.pTFzp\P!\ T4P4RR7o\T3Rl\ 4R4pTe\PR YV4KiTP#S4K| \T4# \ dR u#i;i \d\PRT4Ki;i) aCIDR blocks this host's local proxy answers DNS with (``security.fake_ip_ranges``). A TUN proxy in fake-ip mode answers every non-filtered name with an address from its own block; that answer is the proxy's sentinel, not an internal host's, so treating it as a private target blocks every outbound fetch on such a host (web_extract, platform attachment downloads, the browser relay). Empty by default: no host gets the exemption unless it declares one, and the sentinel range keeps the ordinary private-address verdict otherwise. rcrmfake_ip_rangesNF)strictz6Ignoring unparseable security.fake_ip_ranges entry: %rc3<"TF<qPSP8XgKSPV4'gK8VxK> R#5ir)versionoverlaps)r rnets& rr"*_resolve_fake_ip_ranges..s6p!?A99PSP[P[C[a`c`l`lmn`oaa!?sAA AzNIgnoring security.fake_ip_ranges entry %r: it overlaps %s, which stays blockedr&)rprdrr1rqrrr+listr~rRrSr2r5loggerwarningrN_FAKE_IP_UNDECLARABLE_NETWORKSappend)rdrvrBentriesnetworksentryclashrs @r_resolve_fake_ip_rangesrs5!%%j"5-7t-D-Deii()$"#s++se 3u 8V8V\^GH &&s5z'7'7'9%HCp!?prvw   NNkmr z  ?    NNSUZ [  s(2DD /D" DD"!EEc$V^8dQhR\/#rr})rs"rrrs"""rcl\4e \4#\'gR\4uss\#)zProcess-lifetime cache with the same profile-scope bypass as ``_global_allow_private_urls``: a multiplex gateway must not apply the first profile's declaration to later ones.T)r rryrzr&rr_global_fake_ip_rangesrs4 !-&((  48:Q:S11 !!rcFV^8dQhR\\,R\/#)rhostr)rr+)rs"rrrs44hsm44rcpT;'gRP4P4PR4#)rb.)r2r7rstrip)rs&r_normalize_hostnamers+ JJB    % % ' . .s 33rcFV^8dQhR\R\\,/#)rr:r)r+r _IPAddress)rs"rrrs 4rcT\P!V4# \dR#i;i)z/IP object for a literal-IP hostname, else None.N)rR ip_addressr5)r:s&r _parse_iprs*##H-- s  ''c$V^8dQhR\/#)r addr_infor)rs"rrrs--#-rc#"VF8wpr#V^,pVPR4^,pWE\V43xK: R#5i)uYield ``(raw, ip_str, ip)`` per getaddrinfo answer. ``ip_str`` has any IPv6 scope ID (``%eth0``) stripped; ``ip`` is None when still unparseable — each caller decides skip/fail/raise.%N)splitr)r_family_sockaddrrBip_strs& r_iter_resolved_ipsrsE'0"Aqqk3"9V,,,'0sAAcFV^8dQhR\R\\,/#)rr:port)r+rint)rs"rrrs"TT3ThsmTrcj\P!W\P\P4#r)socket getaddrinfo AF_UNSPEC SOCK_STREAM)r:rs&&r _getaddrinfors#   hf.>.>@R@R SSrc0V^8dQhR\R\/#ripr)r)rs"rrrs  z j rc\V\P4'dLVPe VP#V\9d'\P !\ V4R,4#V#)uVThe IPv4 address an IPv6 wrapper stands for — IPv4-mapped (``::ffff:x.x.x.x``) or IPv4-translated (``::ffff:0:x.x.x.x``); *ip* unchanged otherwise. ``ipaddress`` reads both wrappers as distinct IPv6 addresses, so every classification must see through them, or a resolver's sentinel / a cloud-metadata answer arrives as unrelated IPv6 space.l)r1rR IPv6Address ipv4_mapped_IPV4_TRANSLATED_NETWORK IPv4Addressrrs&r_embedded_ipv4rsS "i++,, >> %>> ! ) )((R:)=> > Irc0V^8dQhR\R\/#rrr)rs"rrrs[[j[T[rca\S4oS\9;'gC\;QJd#V3Rl\4F 'gK R# R#!V3Rl\44#)c3.<"TF pSV9xK R#5irr&r rrs& rr"(_is_always_blocked_ip.. s+ZAY#B#IAYTF)r_ALWAYS_BLOCKED_IPSr$_ALWAYS_BLOCKED_NETWORKSrsfr_is_always_blocked_iprsF  B $ $ Z Z+ZAY+ZZZ+ZAY+Z(ZZrc0V^8dQhR\R\/#rr)rs"rrr s>>Z>D>rca\S4o\;QJd'V3Rl\44F 'gK R# R#!V3Rl\444#)aTrue when *ip* falls in a block declared in ``security.fake_ip_ranges``. The dial still goes to the local proxy, which resolves and connects to the real target, so a declared block grants no reach an attacker lacks through the proxy's own DNS; undeclared ranges keep the private verdict.c3.<"TF pSV9xK R#5irr&rs& rr"'_is_declared_fake_ip..s=$> L L L L"$"3"3 L L79^7KMrc0V^8dQhR\R\/#r)r+r)rs"rrrs$$s$t$rcv\\V4P4pV'gR#V\9d\P RV4R#\ V4pVe,\V4'd\P RV4R#R#\V4p\T4FLwrEpTf\P RYA4K"\T4'gK5\P RY4R# R# \PdR#i;i \d"p\PRY4Rp?R#Rp?ii;i) uTrue when the URL targets the always-blocked floor (cloud metadata) — only the sentinel hostnames/IPs, regardless of backend, routing, or ``allow_private_urls``. For callers that deliberately bypass the full check (e.g. hybrid cloud browser routing private URLs to a local sidecar) but must still enforce the floor. False for ordinary private/loopback URLs, DNS failures and parse errors (the caller's ordinary fail-closed path handles those).Fz?Blocked request to internal hostname (always-blocked floor): %sTNzDBlocked request to cloud metadata address (always-blocked floor): %su>Unparseable IP address %r for hostname %s — skipping addresszJBlocked request to cloud metadata address (always-blocked floor): %s -> %sz&is_always_blocked_url error for %s: %s)rr r:_BLOCKED_HOSTNAMESrrrrrrgaierrorrrrdebug)r*r:rrrBrresolvedexcs& ris_always_blocked_urlrs &x}'='=> ) ) NN\^f g x  >$R((egop $X.I&8 %B !C_ado$X..`bj&C    =sHsR&D !D 6D  C0;D D ,D 0D D D  D D8D33D8c<V^8dQhR\R\R\/#)rr:r6rr)rs"rrrDs&GGCGGGrc.VR8H;'d V\9#)zGReturn True when a trusted HTTPS hostname may bypass IP-class blocking.r)_TRUSTED_PRIVATE_IP_HOSTS)r:r6s&&r_allows_private_ip_resolutionrDs W  F F-F!FFrcRV^8dQhR\R\R\\,/#)rr allow_privater)rrrr+)rs"rrrIs%*Thsmrc\V4'dR#V'g%\V4'd\V4'gR#R#)zWhy a resolved answer must be rejected, or None if it may be dialed. The metadata floor ignores ``allow_private``; ordinary private/internal classes are blocked only when it is False.zcloud metadata addresszprivate/internal addressN)rrr)rrs&&r_resolved_ip_block_reasonrIs0R  ' ^B//8LR8P8P) rc0V^8dQhR\R\/#r)r)rs"rrrSs33S3T3rc\V4p\VP4pVP;'gRP 4P 4pV\ 9d#\PRT;'gR4R#V'gR#V\9d\PRV4R#\4p\W#4pT;'gTp\V4p\%T4FLwrp T f\PR Y4R#\'Y4p T fK4\PR YT 4R# T'd\P#R T4R#T'd\P#R T4R# \PdQ\T4f*\!4'd\P#RT4R#\PR T4R#i;i \(d"p \PRY 4Rp ? R#Rp ? ii;i)aTrue if the URL target is not a private/internal address. Resolves the hostname and checks every answer; fails closed on DNS errors and unexpected exceptions. ``allow_private_urls`` skips private-IP blocking, but cloud metadata endpoints remain blocked regardless.rbu.Blocked request — unsupported URL scheme: %szFz(Blocked request to internal hostname: %sNu]DNS resolution failed for %s — proxy configured, allowing through for proxy-side resolutionTu1Blocked request — DNS resolution failed for: %su=Blocked request — unparseable IP address %r for hostname %szBlocked request to %s: %s -> %szKAllowing private/internal resolution (security.allow_private_urls=true): %szAAllowing trusted hostname despite private/internal resolution: %su5Blocked request — URL safety check error for %s: %s)r rr:r6r2r7r8rrrr^rrrrrr'rrrrr) r*rCr:r6allow_all_privateallow_private_iprrrBrrreasonrs & r is_safe_urlrSs/#&v7--%%2,,.446  & NNKVM`M`W` a ) ) NNEx P688J)==-=  $X.I 2)GGG6AG>GGGGG H )HH c0V^8dQhR\R\/#r)r)rs"rrrs5555rcT"\P!\V4GRjxL #L5i)zB:func:`is_safe_url` with the blocking DNS work off the event loop.N)asyncio to_threadr)r*s&rasync_is_safe_urlrs"";4 44 4s (&(c]tRtRtRtRtR#)SSRFConnectionBlockedizGRaised when connect-time DNS resolution violates the URL safety policy.r&N)__name__ __module__ __qualname____firstlineno____doc____static_attributes__r&rrrrsQrrc ^V^8dQhR\R\R\R\\,/#)rrrr6rr+rr)rs"rrrs,SST#Yrc d\V4pV'g \R4hV\9d\RV 24h\4;'g \ W24p\ W14p.p\T4F|wrp T f!\RT: RT 24\T : R24h\Y4p T e\RT R T R T 24hY9gKU\T4\8gKkTPT 4K~ T'g\R T 24hT# \ Pdp\RT 24ThRp?ii;i) zResolve and validate *host* at TCP-connect time; return dialable IP strings. Closes the DNS-rebinding gap between pre-flight validation and connect for direct httpx clients. The result is capped at ``_MAX_SSRF_CONNECT_IPS``, but EVERY answer is validated.z#Blocked request with empty hostnamez&Blocked request to internal hostname: z-Blocked request - DNS resolution failed for: Nz)Blocked request - unparseable IP address z for hostname z. does not appear to be an IPv4 or IPv6 addresszBlocked request to z during connect: z -> z/Blocked request - DNS returned no results for: )rrrr^rrrrrr5rlen_MAX_SSRF_CONNECT_IPSr) rrr6r:rrrsafe_ipsrBrrrs &&& r_resolved_http_connect_ipsrsS#4(H #$IJJ%%#&LXJ$WXX.0cc4QRZ4cMi 0 H-i8R :';C7.QYPZ[ *XYZ [+2=  '*=fXEVW_V``dekdl(mn n  !c(m6K&K OOF #9 #&UV^U_$`aa O ??i#&ST\S]$^_ehhis DD/D**D/ca]tRtRtoRtV3RlRltV3RlRlt]V3RlRl4t]V3R lR l4t RV3R lR llt Rt Vt R #)_SSRFGuardedBackendBaseia httpcore backend that re-resolves + validates at connect time and dials a vetted IP. Host/SNI stay on the original hostname; Unix sockets are refused outright. Candidate IPs are tried in order and the last connect error is re-raised so callers see the real failure.c&<V^8dQhRS[RS[/#)rbackendschemes_by_origin_varr)r __classdict__s"rr$_SSRFGuardedBackendBase.__annotate__s<<>>C>DI>rcVPP/4PW34;'g VR8XdRMRp\WV4#)irr)r rr)r rrr6s&&& r _connect_ips$_SSRFGuardedBackendBase._connect_ipssF,,00488$FnnVZ^aVa7gm)$f==rc <V^8dQhRS[/#rr})rrs"rrrs@@U@rc:^RIpVPVP3#)N)httpcore ConnectErrorConnectTimeout)rs r_connect_errors'_SSRFGuardedBackendBase._connect_errorss%%x'>'>??rc:<V^8dQhRS[RS[R,RS[/#)rrlast_excNr)r+rr)rrs"rrrs,bbSbI,<bbrc*VeV#\RV 24#)Nz2Blocked request - DNS returned no usable IPs for: r)rrs&&r_no_usable_ips&_SSRFGuardedBackendBase._no_usable_ipss"  O$'YZ^Y_%`aarNc@<V^8dQhRS[RS[R,RS[RS[/#rr?timeoutNsocket_optionsrr+floatr)rrs"rrrs5]]]edl][^]jm]rc\R4hz5Blocked Unix socket connection in SSRF-safe transportrr r?r$r%s&&&&rconnect_unix_socket+_SSRFGuardedBackendBase.connect_unix_sockets#$[\\rr NN) rrrrrrr staticmethodrr r+r__classdictcell__)rs@rrrs]_<<>>@@bb ]]]rrc|aa]tRtRtoV3RlV3RlltR V3RlRlltR V3RlRlltV3RlR ltR tVt V;t #) _SSRFGuardedAsyncNetworkBackendic <V^8dQhRS[/#rrr)rrs"rr,_SSRFGuardedAsyncNetworkBackend.__annotate__??c?rc><^RIHp\SV` V!4V4R#)r) AutoBackendN)httpcore._backends.autor7superr)r rr7 __class__s&& rr(_SSRFGuardedAsyncNetworkBackend.__init__7 (=>rc Z<V^8dQhRS[RS[RS[R,RS[R,RS[RS[/#rrrr$N local_addressr%rr+rr'r)rrs"rrr4sB 2 2c 2 2ut| 2),t 2LO 2[^ 2rc 0"Rp\P!VPW4GRjxL F*pVPP WrW4VR7GRjxL u# VP W4hLCL TP 4dpTpRp?K`Rp?ii;i5iN)r$r?r%)rrrr  connect_tcprr  r rrr$r?r%rrrs &&&&&& rrC+_SSRFGuardedAsyncNetworkBackend.connect_tcps%)))$*;*;THHHB !]]66g[i7kkkI !!$11 Ik'')  sJ'BA-B!A1A/A1B/A11BBBBBc@<V^8dQhRS[RS[R,RS[RS[/#r#r&)rrs"rrr4s5]]c]EDL]ad]ps]rc "\R4h5ir)rr*s&&&&rr+3_SSRFGuardedAsyncNetworkBackend.connect_unix_sockets#$[\\s c$<V^8dQhRS[RR/#rsecondsrNr')rrs"rrr4s++5+T+rcX"VPPV4GRjxL R#L5irr sleepr rKs&&rrO%_SSRFGuardedAsyncNetworkBackend.sleepsmm!!'***s *(*r&NNNr-) rrrrrrCr+rOrr/ __classcell__r:rs@@rr1r1s4?? 2 2]]+++rr1cfaa]tRtRtoV3RlV3RlltR V3RlRlltV3RlRltRtVtV;t #) _SSRFGuardedNetworkBackendic <V^8dQhRS[/#r3r)rrs"rr'_SSRFGuardedNetworkBackend.__annotate__r5rc><^RIHp\SV` V!4V4R#)r) SyncBackendN)httpcore._backends.syncrZr9r)r rrZr:s&& rr#_SSRFGuardedNetworkBackend.__init__r<rc Z<V^8dQhRS[RS[RS[R,RS[R,RS[RS[/#r>r@)rrs"rrrXsB 2 2 23 2 2#&: 2FI 2UX 2rc RpVPW4F"pVPPWrW4VR7u# VP W4h TP4dpTpRp?KTRp?ii;irB)rr rCrr rDs &&&&&& rrC&_SSRFGuardedNetworkBackend.connect_tcpsz%)##D/B }}00g[i1kk0 !!$11'')  sA  A- A((A-c$<V^8dQhRS[RR/#rJrL)rrs"rrrXs%%U%t%rc<VPPV4R#rrNrPs&&rrO _SSRFGuardedNetworkBackend.sleeps G$rr&rR) rrrrrrCrOrr/rSrTs@@rrVrVs(?? 2 2%%%rrVctV^8dQhR\R\\\\3,\3,/#rrequestr)rrqr~r+r)rs"rrrs0ccCcDsCx#1E,FcrcVPPVPPVPPr2pV'dVeV\9dW3V/#/#r)r*rrr6r8)rerrr6s& r_origin_scheme_contextrgsL ))7;;+;+;W[[=O=OD%)d.>6]CZTL& !b`bbrc0V^8dQhR\R\/#)rrrer)rs"rrrs+++s+rc#"VP\V44pRxVPV4R# TPT4i;i5i)zUExpose the request's origin scheme to the connect-time backend for this request only.N)setrgreset)rretokens&& r _origin_scopermsB " % %&.__annotate__s))S)S)rc<"\SV4;_uu_4S!V4GRjxL uuRRR4#L +'giR#;i5irrmrehandlers&r guarded_async7_install_ssrf_guard_on_transport..guarded_asyncs4 0' : :(; :(; : :s%A  535 A 5 A A c0V^8dQhR\R\/#rdr)rs"rrrzs##c#c#rcz<\SV4;_uu_4S!V4uuRRR4# +'giR#;irr|r}s&r guarded_sync6_install_ssrf_guard_on_transport..guarded_syncs' 0' : :'?; : : :s) : T) getattrrhasattrrr1rVrvsetattrrt) rprrnstatelabelpool backend_cls method_namerrr~s &f$ @r _install_ssrf_guard_on_transportrs3<2GGIz2 .REEII&D,4(:JK YT 2F ~#l5'9R$STT))## IXM<P%)I"rc4V^8dQhR\R\RR/#)rclientrnrNrq)rs"rrr"s&pp#pDpTprc^RIpV'dRMRp\\VR/4PR4VP V4VR7R#)zTGuard ``client._transport`` only; ``_mounts`` (env/explicit proxies) stay untouched.N hermes_ssrf_async_origin_schemeshermes_ssrf_origin_schemesrs _transportrn) contextvarsrrr ContextVar)rrnrvar_names&$ r_install_ssrf_guard_on_clientr"sA5=1C_H$ B'++L9;;Q;QRZ;[fnprc0V^8dQhR\R\/#rkwargsrr)rs"rrr*sCCrc L^RIpVP!R/VBp\VRR7V#)z``httpx.AsyncClient`` with connect-time SSRF validation: direct HTTP(S) connections are resolved, validated, and dialed by IP while the hostname is preserved for Host, SNI, and certificate verification. Proxied requests delegate resolution to the proxy.NTrr&)httpx AsyncClientrrrrs, rcreate_ssrf_safe_async_clientr*s)    ( (F!&48 Mrc0V^8dQhR\R\/#rr)rs"rrr4sccrc H^RIpVP!R/VBp\V4V#)z=Create an ``httpx.Client`` with connect-time SSRF validation.Nr&)rClientrrs, rcreate_ssrf_safe_clientr4s# \\ #F #F!&) MrcFV^8dQhR\R\\,/#)rresponser)rrr+)rs"rrr<s ; ;C ;HSM ;rc 2\VRR4'gR#\VR/4;'g/PR4pV'd*\\\VRR44\V44#\VRR4pV'd\VP4#R#) uRedirect target visible from inside an httpx response hook. ``response.next_request`` is frequently ``None`` inside hooks (populated later by the follower), which would make an SSRF redirect guard silently never fire — so resolve from ``Location`` first, then ``next_request``. is_redirectFNheaderslocationr*rb next_request)rrrr+r*)rrrs& rredirect_target_from_responser<s 8]E 2 2)R066B;;JGHs78UB78#h-HH8^T:L$03| :d:r) HTTPS_PROXY https_proxy HTTP_PROXY http_proxy ALL_PROXY all_proxy>jwtrlapikeypasswdsecretapi_keypassword signature auth_token credential session_id credentials access_token authorization client_secretawsaccesskeyidx_amz_signaturex_amz_security_tokenx-amz-signaturex-amz-security-token)z169.254.169.254z 169.254.170.2z169.254.169.253z100.100.100.200)169.254.0.0/16z::ffff:169.254.0.0/112) z 0.0.0.0/32z 127.0.0.0/8z 10.0.0.0/8z 172.16.0.0/12z192.168.0.0/16rrWz::/128z::1/128zfc00::/7z fe80::/10r&r)TrrRloggingrrrr3 contextlibrtypingrr urllib.parserrrrr r r hermes_constantsr utilsr getLoggerrrr% frozensetr8rrrr'rErIrOr _METADATA_V4rrr~rrrrSrrrr\r]ryrzr^r[r{rrrrrrrrrrrrrrrr5rrrr1rVrgrmrrrrrrs0rrs   % [[[5!   8 $g67+,  " "Y%:%: : ;gF )*/ 0 [" :OLM  (45 "Y" 56BClyIN+lCDO,-. !5 oBn o55 oBn oo&'@&AB%%o6 %//0AB "''I''I'"27..,12)) !& >"4-T [ >M$NG 3l5 RJR<]]8+&=+.%!8%(c ++*ej*8p5p ;a6Cs 0I7!I<