o Tj@shddlmZddlZddlZddlmZmZmZmZGdddZ dd d Z dd dZ GdddZ dS)) annotationsN)ASGI3ApplicationASGIReceiveCallableASGISendCallableScopec@s&eZdZdZddd d ZdddZdS)ProxyHeadersMiddlewareaBMiddleware for handling known proxy headers This middleware can be used when a known proxy is fronting the application, and is trusted to be properly setting the `X-Forwarded-Proto` and `X-Forwarded-For` headers with the connecting client information. Modifies the `client` and `scheme` information so that they reference the connecting client, rather that the connecting proxy. References: - - 127.0.0.1appr trusted_hostslist[str] | strreturnNonecCs||_t||_dSN)r _TrustedHostsr )selfr r rc/home/dinkstrade/pdmp-scanner/venv/lib/python3.10/site-packages/uvicorn/middleware/proxy_headers.py__init__szProxyHeadersMiddleware.__init__scoperreceiversendrcs |ddkr||||IdHS|d}|r|dnd}||jvr|d}g}|dD]\}} |dkr6| }q+|dkr?|| q+|durb|d} | d vrb|dd kr^| d d |d <n| |d <|r|d|d} |j| \} } | r|| | f|d<||||IdHS)Ntypelifespanclientrheaderssx-forwarded-protosx-forwarded-forlatin1>wswsshttphttps websocketrrschemes, ) r getr appenddecodestripreplacejoinget_trusted_client_address)rrrr client_addr client_hostx_forwarded_proto_valuex_forwarded_for_valuesnamevaluex_forwarded_protox_forwarded_forhostportrrr__call__s4      zProxyHeadersMiddleware.__call__N)r)r rr r r r )rrrrrrr r )__name__ __module__ __qualname____doc__rr3rrrrr s rr.strr list[str]cCsdd|dDS)NcSsg|]}|qSr)r%).0itemrrr Csz$_parse_raw_hosts..,)split)r.rrr_parse_raw_hostsBsr?tuple[str, int]cCs|drH|d}|dkr|dfS|d|}||dd}|s&|dfS|ds/|dfSz |t|ddfWStyG|dfYSw|ddkrl|dd\}}z|t|fWStyk|dfYSw|dfS)a&Parse a forwarded host value into host and optional port. Accepts bare IPs, IPv4 `host:port`, and bracketed IPv6 `[host]:port`. Any unrecognized or malformed value is treated conservatively and returned without a port so trust checks do not silently normalize arbitrary input. []rN:) startswithfindint ValueErrorcountrsplit)r. bracket_endr1 remainderr2rrr_parse_host_portFs.        rNc@s8eZdZdZdddZdd d ZdddZdddZdS)rz(Container for trusted hosts and networksr r r r c Cs|ddgfv|_t|_t|_t|_|js^t|tr t|}|D];}d|vrCz |jt |Wq"t yB|j|Yq"wz |jt |Wq"t y]|j|Yq"wt jdd|j|_dS)N*/i)maxsize) always_trustsettrusted_literalsr trusted_networks isinstancer8r?add ipaddress ip_networkrI ip_address functools lru_cache_compute_trust_trusts)rr r1rrrrls(   z_TrustedHosts.__init__r1 str | NoneboolcCs2|jrdS|s dSt|dkr||S||S)NTF)rRlenr]r^rr1rrr __contains__s   z_TrustedHosts.__contains__r8csLzt||jvptfdd|jDWSty%||jvYSw)Nc3s|]}|vVqdSrr)r:netiprr sz/_TrustedHosts._compute_trust..)rXrZr anyrUrIrTrcrrfrr]s  $ z_TrustedHosts._compute_trustr0r@cCsTt|}|jr t|dSt|D]}t|\}}||vr#||fSqt|dS)zExtract the client address from x_forwarded_for header. In general this is the first "untrusted" host in the forwarded for list. r)r?rRrNreversed)rr0x_forwarded_for_hosts host_portr1r2rrrr(s     z(_TrustedHosts.get_trusted_client_addressN)r r r r )r1r_r r`)r1r8r r`)r0r8r r@)r4r5r6r7rrdr]r(rrrrris   ) r)r.r8r r9)r.r8r r@) __future__rr[rXuvicorn._typesrrrrrr?rNrrrrrs  9 #