authcaptureproxy 1.3.8__tar.gz → 1.3.9__tar.gz

{authcaptureproxy-1.3.8 → authcaptureproxy-1.3.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: authcaptureproxy
-Version: 1.3.8
+Version: 1.3.9
 Summary: A Python project to create a proxy to capture authentication information from a webpage. This is useful to capture oauth login details without access to a third-party oauth.
 License-Expression: Apache-2.0
 License-File: LICENSE.txt

{authcaptureproxy-1.3.8 → authcaptureproxy-1.3.9}/authcaptureproxy/auth_capture_proxy.py

@@ -3,9 +3,9 @@
 
 import asyncio
 import logging
-import posixpath
 import re
 from functools import partial
+from html import escape, unescape
 from json import JSONDecodeError
 from ssl import SSLContext
 from typing import Any, Callable, Dict, List, Optional, Set, Text, Tuple, Union
@@ -684,7 +684,6 @@ class AuthCaptureProxy:
             # Resolve relative form actions BEFORE modifiers run.
             if text and content_type == "text/html" and resp and resp.url:
                 _resp_url = URL(str(resp.url))
-                _resp_dir = _resp_url.path.rsplit("/", 1)[0] + "/" if "/" in _resp_url.path else "/"
 
                 def _resolve_form_action(form_match):
                     """Resolve relative action URLs only inside <form> tags."""
@@ -696,10 +695,13 @@ class AuthCaptureProxy:
                     if action and not action.startswith(
                         ("http://", "https://", "//", "#", "javascript:", "/")
                     ):
-                        resolved_path = posixpath.normpath(_resp_dir + action)
+                        resolved_url = _resp_url.join(URL(unescape(action)))
                         _proxy_base = self.access_url().path.rstrip("/")
                         abs_url = str(
-                            self.access_url().with_path(_proxy_base + resolved_path).with_query({})
+                            self.access_url()
+                            .with_path(_proxy_base + resolved_url.path)
+                            .with_query(resolved_url.query)
+                            .with_fragment(resolved_url.fragment)
                         )
                         _LOGGER.debug(
                             "Resolved relative form action '%s' -> '%s' (page: %s)",
@@ -707,7 +709,11 @@ class AuthCaptureProxy:
                             abs_url,
                             _resp_url.path,
                         )
-                        return form_tag[: action_m.start(2)] + abs_url + form_tag[action_m.end(2) :]
+                        return (
+                            form_tag[: action_m.start(2)]
+                            + escape(abs_url, quote=True)
+                            + form_tag[action_m.end(2) :]
+                        )
                     return form_tag
 
                 text = re.sub(
@@ -893,18 +899,25 @@ class AuthCaptureProxy:
             result["Referer"] = self._swap_proxy_and_host(
                 result.get("Referer", ""), domain_only=True
             )
-        for item in [
-            "Content-Length",
-            "X-Forwarded-For",
-            "X-Forwarded-Host",
-            "X-Forwarded-Port",
-            "X-Forwarded-Proto",
-            "X-Forwarded-Scheme",
-            "X-Forwarded-Server",
-            "X-Real-IP",
-        ]:
-            # remove proxy headers
-            if result.get(item):
+        # Remove hop-by-hop and reverse-proxy/CDN headers that must not be forwarded
+        # upstream. Besides leaking client info, these can carry non-ASCII values (e.g.
+        # Cloudflare's "cf-ipcity: Mérida") that break httpx header encoding. Matching is
+        # case-insensitive because HTTP/2 front-ends (e.g. Cloudflare) lowercase header
+        # names, so exact-case matching would silently miss them.
+        proxy_headers = {
+            "content-length",
+            "x-forwarded-for",
+            "x-forwarded-host",
+            "x-forwarded-port",
+            "x-forwarded-proto",
+            "x-forwarded-scheme",
+            "x-forwarded-server",
+            "x-real-ip",
+            "cdn-loop",
+        }
+        for item in list(result):
+            lowered = item.lower()
+            if lowered in proxy_headers or lowered.startswith("cf-"):
                 result.pop(item)
         result.update(self.headers if self.headers else {})
         _LOGGER.debug("Final headers %s", result)

{authcaptureproxy-1.3.8 → authcaptureproxy-1.3.9}/authcaptureproxy/helper.py

@@ -5,7 +5,6 @@ Python Package for auth capture proxy.
 Helper files.
 """
 
-import ast
 import json
 import logging
 import re
@@ -39,11 +38,11 @@ def print_resp(resp: Union[httpx.Response, ClientResponse]) -> None:
     method = resp.request.method
     status = resp.status_code
     reason = resp.reason_phrase
-    headers = ast.literal_eval(str(resp.request.headers)[8:-1])
+    headers: Dict[str, Any] = dict(resp.request.headers)
     cookies = {}
     if headers.get("cookie"):
         cookie: SimpleCookie = SimpleCookie()
-        cookie.load(headers.get("cookie"))
+        cookie.load(headers["cookie"])
         for key, morsel in cookie.items():
             cookies[key] = morsel.value
         headers["cookie"] = cookies
@@ -74,13 +73,11 @@ def print_resp_aiohttp(resp: ClientResponse) -> None:
     method = resp.request_info.method
     status = resp.status
     reason = resp.reason
-    headers = ast.literal_eval(
-        str(resp.request_info.headers).replace("<CIMultiDictProxy(", "{").replace(")>", "}")
-    )
+    headers: Dict[str, Any] = dict(resp.request_info.headers)
     cookies = {}
     if headers.get("Cookie"):
         cookie: SimpleCookie = SimpleCookie()
-        cookie.load(headers.get("Cookie"))
+        cookie.load(headers["Cookie"])
         for key, morsel in cookie.items():
             cookies[key] = morsel.value
         headers["Cookie"] = cookies

{authcaptureproxy-1.3.8 → authcaptureproxy-1.3.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "poetry.core.masonry.api"
 
 [project]
 name = "authcaptureproxy"
-version = "1.3.8"
+version = "1.3.9"
 description = "A Python project to create a proxy to capture authentication information from a webpage. This is useful to capture oauth login details without access to a third-party oauth."
 readme = "README.md"
 authors = [