yjdZddlmZddlZddlZddlZddlmZm Z ddl m Z e ddhZ dd d ZddZGddejjZGddejjZd dZddd!dZgdZdS)"z>Security policy for credential-bearing stdlib urllib requests.) annotationsN)CallableIterable)Anyacceptz user-agentPi)httphttpsurlstrreturntuple[str, str, int | None]ctj|}|jpd}|j}||jpdd||nt |fS)z>Return a normalized (scheme, hostname, effective port) origin..) urllibparseurlparseschemelowerporthostnamerstrip_DEFAULT_PORTSget)r parsedrrs @/home/ragecks/.hermes/hermes-agent/hermes_cli/urllib_security.py url_originrs \ " "3 ' 'Fm!r ( ( * *F ;D  B%%''..s33 n&8&8&@&@ c0eZdZdZedd d Zfd ZxZS) SafeCredentialRedirectHandlerzAPreserve request headers only while redirects stay on one origin.)cross_origin_safe_headers original_urlr r" Iterable[str]r Nonecjt||_td|D|_dS)Nc3XK|]%}t|V&dSN)r r).0names r z9SafeCredentialRedirectHandler.__init__..)sC4 4 "&CIIOO  4 4 4 4 4 4 r)r_original_origin frozenset_cross_origin_safe_headers)selfr#r"s r__init__z&SafeCredentialRedirectHandler.__init__"sH !+< 8 8*34 4 *C4 4 4 + + '''rct||||||}|dStj|j|}t ||jkrWt| D]5\} } | |j vr| | 6|Sr() superredirect_requestrrurljoinfull_urlrr,list header_itemsrr. remove_header) r/reqfpcodemsgheadersnewurl redirected resolved_urlr*_value __class__s rr3z.SafeCredentialRedirectHandler.redirect_request-sWW--c2tS'6RR  4|++CL&AA l # #t'< < <!%Z%<%<%>%> ? ? 3 3 f::<z8_secure_opener_from_installed_policy..\sG '6>#EFF 'rhandlersrU_hermes_initial_addheaders addheaders) getattrrrM build_openerappendr!rJsetattrr6r`)r# installedr^secureds r$_secure_opener_from_installed_policyrgVs 488IN//11 y*b99H  OO1,??@@@ OO0>>???n)84G $ WY b 1 122 G Nr)opener_factoryrMrNtimeoutrQrhCallable[..., Any] | Nonec|Wt|j}t|ddD]0\}}||s|||1n|t |j}|||S)abOpen a request without forwarding credentials across origins. The default preserves an application-installed opener's proxy, TLS, cookies, custom protocol handlers, and instrumentation while replacing its redirect handler. ``opener_factory`` is an explicit test seam; security is never disabled based on global ``urlopen`` identity. Nr_rU)ri)rgr5ra has_header add_headerr!open)rMrirhopenerr*values ropen_credentialed_urlrqps5g6FGG"6+GLL 0 0KD%%%d++ 0""4/// 0  =g>N O OPP ;;w; 0 00r)r!rqr)r r r r)r#r )rMrNrirQrhrj)rF __future__rr[ urllib.parserurllib.requestcollections.abcrrtypingrr-rGrrrMrZr! BaseHandlerrJrgrq__all__rUrrrysJDD"""""" ........'Y,'?@@s++    FN$F<6>#=2<15 111111.   r