j! dZddlZddlZddlZddlmZddlmZeje Z dZ Gdde Z ded efd Zd ed efd Zy) aRejects user-supplied URLs that point inside the network. Any endpoint that fetches a URL a user chose is an SSRF sink: pointed at cloud instance metadata it leaks credentials, pointed at an RFC1918 address it reaches services that were never meant to be public. N)Any)urlparse)httpsceZdZdZy)UnsafeUrlErrorz:The URL points somewhere this service must not fetch from.N)__name__ __module__ __qualname____doc__6/var/www/html/strategist-ai/app/services/infra/ssrf.pyrrsDr rhostreturnc`tj|dDcgc] }|dd c}Scc}w)Nr)socket getaddrinfo)rinfos r_resolvers+#)#5#5dD#A B4DGAJ BB Bs+urlcf|rt|ts td t|}|j}|j tvrtd|j d|s td t|}|D]n}tj|}|js=|js1|js%|j s|j"s |j$satd|d|S#t $r}td|d}~wwxYw#ttf$r}td|d|d}~wwxYw) Nzurl must be a non-empty stringzurl could not be parsedzscheme z is not allowedzurl has no hostzhost z does not resolvez! resolves to a non-public address) isinstancestrrrhostname ValueErrorschemeALLOWED_SCHEMESrOSError UnicodeError ipaddress ip_address is_private is_loopback is_link_local is_reserved is_multicastis_unspecified)rparsedrex addressesrawips rassert_safe_urlr.s? jc*=>> @#??}}O+wv}}&7GHH .//LX&  G ! !# & MMR^^r/?/?>>R__8I8I!|#DEG G G J7 @67R?@ \ "LuXL0ABCK Ls/C// D / D 8 DD  D0D++D0)r r!loggingrtypingr urllib.parser getLoggerrloggerr Exceptionrrlistrr.r r rr6sk  !   8 $ EYEC3C4C%%%r