
    1Vh*                         d Z ddlZddlmZ ddlmZ ddlmZ ddlm	Z	  e	j                         ZdZdZd	d
gdd
gdgd
gdZ ej                  d       G d d             Zd Z G d d      Zy)z0Validates responses and their security features.    N)
Collection)Headers)http)
tb_loggingz	text/htmlzdefault-srcz'unsafe-inline'zdata:zblob:z'unsafe-eval')z	style-srczimg-srcz
script-srczfont-srcT)frozenc                   ,    e Zd ZU dZeed<   ee   ed<   y)	DirectivezContent security policy directive.

    Loosely follow vocabulary from https://www.w3.org/TR/CSP/#framework-directives.

    Attributes:
      name: A non-empty string.
      value: A collection of non-empty strings.
    namevalueN)__name__
__module____qualname____doc__str__annotations__r        V/home/dcms/DCMS/lib/python3.12/site-packages/tensorboard/backend/security_validator.pyr	   r	   ,   s     Ic?r   r	   c                 4    t         j                  d| z         y )Nz-In 3.0, this warning will become an error:
%s)loggerwarning)	error_msgs    r   _maybe_raise_value_errorr   ;   s    
NNCiOPr   c                   @    e Zd ZdZd Zd Zd Zd Zd Zd Z	d Z
d	 Zy
)SecurityValidatorMiddlewarea  WSGI middleware validating security on response.

    It validates:
    - responses have Content-Type
    - responses have X-Content-Type-Options: nosniff
    - text/html responses have CSP header. It also validates whether the CSP
      headers pass basic requirement. e.g., default-src should be present, cannot
      use "*" directive, and others. For more complete list, please refer to
      _validate_csp_policies.

    Instances of this class are WSGI applications (see PEP 3333).
    c                     || _         y)zInitializes an `SecurityValidatorMiddleware`.

        Args:
          application: The WSGI application to wrap (see PEP 3333).
        N_application)selfapplications     r   __init__z$SecurityValidatorMiddleware.__init__N   s     (r   c                 8     d fd	} j                  ||      S )Nc                 :    j                  |        | ||      S N)_validate_headers)statusheadersexc_infor   start_responses      r   start_response_proxyzBSecurityValidatorMiddleware.__call__.<locals>.start_response_proxyW   s     ""7+!&'8<<r   r$   r   )r   environr)   r*   s   ` ` r   __call__z$SecurityValidatorMiddleware.__call__V   s    	=   *>??r   c                     t        |      }| j                  |       | j                  |       | j                  |       y r$   )r   _validate_content_type _validate_x_content_type_options_validate_csp_headers)r   headers_listr'   s      r   r%   z-SecurityValidatorMiddleware._validate_headers]   s6    ,'##G,--g6""7+r   c                 >    |j                  d      ry t        d       y )NContent-Typez&Content-Type is required on a Responsegetr   )r   r'   s     r   r.   z2SecurityValidatorMiddleware._validate_content_typec   s    ;;~& !IJr   c                 H    |j                  d      }|dk(  ry t        d       y )NzX-Content-Type-Optionsnosniffz2X-Content-Type-Options is required to be "nosniff"r4   )r   r'   options      r   r/   z<SecurityValidatorMiddleware._validate_x_content_type_optionsi   s'    56Y @	
r   c                     t        j                  |j                  d            \  }}|t        k7  ry |j	                  d      }g }|D ]  }|| j                  |      z  } | j                  |       y )Nr3   zContent-Security-Policy)r   parse_options_headerr5   _HTML_MIME_TYPEget_all_parse_serialized_csp_validate_csp_policies)r   r'   	mime_type_	csp_textspoliciescsp_texts          r   r0   z1SecurityValidatorMiddleware._validate_csp_headersr   sr    00^1LM	1'OO$=>	! 	=H228<<H	= 	##H-r   c                    d}g }|D ]  }|j                   }|j                  D ]y  }|xs	 |t        k(  }|t        j	                  |g       v r)|dk(  s'|dk(  s"|j                  d      s|j                  d      rVdj                  ||      }|j                  |       {  |s|j                  d       |rt        d	j                  |             y y )
NFz'self'z'none'zhttps:z'sha256-z3Illegal Content-Security-Policy for {name}: {value}r
   r   z0Requires default-src for Content-Security-Policy
)
r
   r   _CSP_DEFAULT_SRC_CSP_IGNOREr5   
startswithformatappendr   join)r   rB   has_default_src
violations	directiver
   r   msgs           r   r>   z2SecurityValidatorMiddleware._validate_csp_policies   s    
! 	'I>>D" '"1"MT=M5MKOOD"55 X%(''1''
3KRRU S  !!#&5'	'< B $TYYz%:; r   c                 4   |j                  d      }g }|D ]  }|j                         }|s|j                  d d      }|d   }t        |      dk(  r|d   nd}|j                         }|j                         }t	        ||      }	|j                  |	        |S )N;   r       rE   )splitstriplenlowerr	   rK   )
r   rC   csp_srcspolicytoken
token_fragr
   valuesr   rO   s
             r   r=   z1SecurityValidatorMiddleware._parse_serialized_csp   s     >>#& 	%EKKME T1-Ja=D&)*o&:Z]F ::<D LLNE!t59IMM)$-	%0 r   N)r   r   r   r   r!   r,   r%   r.   r/   r0   r>   r=   r   r   r   r   r   @   s2    (@,K
.(<T"r   r   )r   dataclassestypingr   werkzeug.datastructuresr   werkzeugr   tensorboard.utilr   
get_loggerr   r;   rG   rH   	dataclassr	   r   r   r   r   r   <module>rf      s    7   +  '				    $W-! ##		 d#  $Q
K Kr   