fluidattacks_core_http 12.0.0__tar.gz

fluidattacks_core_http-12.0.0/.envrc

@@ -0,0 +1 @@
+use_flake ".#python311.devShell"

fluidattacks_core_http-12.0.0/.gitignore

@@ -0,0 +1,5 @@
+target/
+.direnv/
+.venv/
+.vscode/settings.json
+.zed/settings.json

fluidattacks_core_http-12.0.0/PKG-INFO

@@ -0,0 +1,16 @@
+Metadata-Version: 2.5
+Name: fluidattacks_core_http
+Version: 12.0.0
+Summary: Fluid Attacks Core HTTP Library
+Author-email: Development <development@fluidattacks.com>
+License: MPL-2.0
+Classifier: Development Status :: 1 - Planning
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Mozilla Public License 2.0 (MPL 2.0)
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Topic :: Software Development :: Libraries
+Requires-Python: >=3.11
+Requires-Dist: aiohttp>=3.10.0
+Requires-Dist: certifi>=2024.8.30
+Requires-Dist: urllib3>=2.6.1

fluidattacks_core_http-12.0.0/build/default.nix

@@ -0,0 +1,20 @@
+{ src, workspace_root }:
+{
+  inherit src workspace_root;
+  root_path = "develops/fluidattacks-core/python/http";
+  module_name = "fluidattacks_core";
+  pypi_token = {
+    method = "oidc";
+  };
+  override = {
+    checks = {
+      basedpyright = false;
+      pytest = false;
+    };
+    configs = {
+      import_linter = ../import-linter.cfg;
+      mypy = ../mypy.ini;
+      ruff = ../ruff.toml;
+    };
+  };
+}

fluidattacks_core_http-12.0.0/build/filter.nix

@@ -0,0 +1,12 @@
+path_filter: src:
+path_filter {
+  root = src;
+  include = [
+    "fluidattacks_core"
+    "import-linter.cfg"
+    "mypy.ini"
+    "pyproject.toml"
+    "ruff.toml"
+    "uv.lock"
+  ];
+}

fluidattacks_core_http-12.0.0/flake.lock

@@ -0,0 +1,303 @@
+{
+  "nodes": {
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib"
+      },
+      "locked": {
+        "lastModified": 1762810396,
+        "narHash": "sha256-dxFVgQPG+R72dkhXTtqUm7KpxElw3u6E+YlQ2WaDgt8=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "0bdadb1b265fb4143a75bd1ec7d8c915898a9923",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "nix_filter": {
+      "locked": {
+        "lastModified": 1757882181,
+        "narHash": "sha256-+cCxYIh2UNalTz364p+QYmWHs0P+6wDhiWR4jDIKQIU=",
+        "owner": "numtide",
+        "repo": "nix-filter",
+        "rev": "59c44d1909c72441144b93cf0f054be7fe764de5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "nix-filter",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1758690382,
+        "narHash": "sha256-NY3kSorgqE5LMm1LqNwGne3ZLMF2/ILgLpFr1fS4X3o=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "e643668fd71b949c53f8626614b21ff71a07379d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1761765539,
+        "narHash": "sha256-b0yj6kfvO8ApcSE+QmA6mUfu8IYG6/uU28OFn4PaC8M=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "719359f4562934ae99f5443f20aa06c2ffff91fc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1758690382,
+        "narHash": "sha256-NY3kSorgqE5LMm1LqNwGne3ZLMF2/ILgLpFr1fS4X3o=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "e643668fd71b949c53f8626614b21ff71a07379d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1761373498,
+        "narHash": "sha256-Q/uhWNvd7V7k1H1ZPMy/vkx3F8C13ZcdrKjO7Jv7v0c=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "6a08e6bb4e46ff7fcbb53d409b253f6bad8a28ce",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_flake": {
+      "locked": {
+        "lastModified": 1778253243,
+        "narHash": "sha256-KkH2QvU6iRLDTGGEwH5jnMqHWj4zMTuHxi1S1zdr01w=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "4fcda7103530b23c5ca44286344912082aad4220",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-build-systems": {
+      "inputs": {
+        "nixpkgs": "nixpkgs",
+        "pyproject-nix": "pyproject-nix",
+        "uv2nix": "uv2nix"
+      },
+      "locked": {
+        "lastModified": 1761781027,
+        "narHash": "sha256-YDvxPAm2WnxrznRqWwHLjryBGG5Ey1ATEJXrON+TWt8=",
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "rev": "795a980d25301e5133eca37adae37283ec3c8e66",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "python_builder",
+          "pyproject-build-systems",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1758265079,
+        "narHash": "sha256-amLaLNwKSZPShQHzfgmc/9o76dU8xzN0743dWgvYlr8=",
+        "owner": "nix-community",
+        "repo": "pyproject.nix",
+        "rev": "02e9418fd4af638447dca4b17b1280da95527fc9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
+    "pyproject-nix_2": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1762427963,
+        "narHash": "sha256-CkPlAbIQ87wmjy5qHibfzk4DmMGBNqFer+lLfXjpP5M=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "4540ea004e04fcd12dd2738d51383d10f956f7b9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
+    "pyproject-nix_3": {
+      "inputs": {
+        "nixpkgs": [
+          "python_builder",
+          "uv2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1760402624,
+        "narHash": "sha256-jF6UKLs2uGc2rtved8Vrt58oTWjTQoAssuYs/0578Z4=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "84c4ea102127c77058ea1ed7be7300261fafc7d2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
+    "python_builder": {
+      "inputs": {
+        "nix_filter": "nix_filter",
+        "nixpkgs_flake": "nixpkgs_flake",
+        "pyproject-build-systems": "pyproject-build-systems",
+        "pyproject-nix": "pyproject-nix_2",
+        "shell-helpers": "shell-helpers",
+        "uv2nix": "uv2nix_2"
+      },
+      "locked": {
+        "dir": "common/utils/python-builder",
+        "lastModified": 1787078362,
+        "narHash": "sha256-HYL7Rn6SuNjYxkt/PwFLksZjsauCiY+ENbOWryLsIlw=",
+        "ref": "refs/heads/trunk",
+        "rev": "09fd25a13309eb5e3b5b2a061bb340df3ae5d281",
+        "shallow": true,
+        "type": "git",
+        "url": "ssh://git@gitlab.com/fluidattacks/universe"
+      },
+      "original": {
+        "dir": "common/utils/python-builder",
+        "rev": "09fd25a13309eb5e3b5b2a061bb340df3ae5d281",
+        "shallow": true,
+        "type": "git",
+        "url": "ssh://git@gitlab.com/fluidattacks/universe"
+      }
+    },
+    "root": {
+      "inputs": {
+        "python_builder": "python_builder"
+      }
+    },
+    "shell-helpers": {
+      "inputs": {
+        "flake-parts": "flake-parts",
+        "nixpkgs": [
+          "python_builder",
+          "nixpkgs_flake"
+        ]
+      },
+      "locked": {
+        "dir": "common/utils/shell-helpers",
+        "lastModified": 1762806066,
+        "narHash": "sha256-Wz99Fl7SpPU1NkTHJ36XOo6DjOEAMXCw3ThRABOS2Hs=",
+        "ref": "refs/heads/trunk",
+        "rev": "d73cfdc7ae9e7f547e22a4481d4c2ccce38b26a8",
+        "shallow": true,
+        "type": "git",
+        "url": "ssh://git@gitlab.com/fluidattacks/universe"
+      },
+      "original": {
+        "dir": "common/utils/shell-helpers",
+        "rev": "d73cfdc7ae9e7f547e22a4481d4c2ccce38b26a8",
+        "shallow": true,
+        "type": "git",
+        "url": "ssh://git@gitlab.com/fluidattacks/universe"
+      }
+    },
+    "uv2nix": {
+      "inputs": {
+        "nixpkgs": [
+          "python_builder",
+          "pyproject-build-systems",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "python_builder",
+          "pyproject-build-systems",
+          "pyproject-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1758933732,
+        "narHash": "sha256-HAmm1GBS1myZCFuog0DC2ZLaynvZtiUI2Crmo+cdQI0=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "273ce18f913d8559e0d04f820d724308966d7c4d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "type": "github"
+      }
+    },
+    "uv2nix_2": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_3",
+        "pyproject-nix": "pyproject-nix_3"
+      },
+      "locked": {
+        "lastModified": 1761872265,
+        "narHash": "sha256-i25GRgp2vUOebY70L3NTAgkd+Pr1hnn5xM3qHxH0ONU=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "74dfb62871be152ad3673b143b0cc56105a4f3c5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

fluidattacks_core_http-12.0.0/flake.nix

@@ -0,0 +1,29 @@
+{
+  description = "Fluid Attacks Core http package.";
+
+  inputs = {
+    python_builder = {
+      url = "git+ssh://git@gitlab.com/fluidattacks/universe?shallow=1&rev=09fd25a13309eb5e3b5b2a061bb340df3ae5d281&dir=common/utils/python-builder";
+    };
+  };
+
+  outputs =
+    { self, ... }@inputs:
+    let
+      build_args =
+        {
+          system,
+          python_version,
+          nixpkgs,
+          builders,
+          scripts,
+        }:
+        import ./build {
+          src = import ./build/filter.nix nixpkgs.nix-filter self;
+          workspace_root = ./.;
+        };
+    in
+    {
+      packages = inputs.python_builder.outputs.build build_args;
+    };
+}

fluidattacks_core_http-12.0.0/fluidattacks_core/http/__init__.py

@@ -0,0 +1,5 @@
+from .client import (
+    request,
+)
+
+__all__ = ["request"]

fluidattacks_core_http-12.0.0/fluidattacks_core/http/client.py

@@ -0,0 +1,90 @@
+import ipaddress
+import ssl
+from collections.abc import Sequence
+from typing import (
+    Any,
+    Literal,
+)
+
+import aiohttp
+import certifi
+
+from .validations import (
+    validate_local_request,
+    validate_url,
+)
+
+
+def get_secure_connector(
+    *,
+    allow_local_network: bool,
+    allow_localhost: bool,
+) -> type[aiohttp.TCPConnector]:
+    class SecureTCPConnector(aiohttp.TCPConnector):
+        async def _resolve_host(
+            self,
+            host: str,
+            port: int,
+            traces: Sequence[aiohttp.tracing.Trace] | None = None,
+        ) -> list[aiohttp.abc.ResolveResult]:
+            hosts = await super()._resolve_host(host, port, traces)
+            resolved_ips = [ipaddress.ip_address(host["host"]) for host in hosts]
+            validate_local_request(
+                resolved_ips,
+                allow_local_network=allow_local_network,
+                allow_localhost=allow_localhost,
+            )
+            return hosts
+
+    return SecureTCPConnector
+
+
+async def request(  # noqa: PLR0913
+    url: str,
+    *,
+    method: Literal["GET", "POST", "PUT", "PATCH", "DELETE"],
+    allow_local_network: bool = False,
+    allow_localhost: bool = False,
+    ascii_only: bool = False,
+    dns_rebind_protection: bool = True,
+    enforce_sanitization: bool = False,
+    headers: dict[str, str] | None = None,
+    json: Any | None = None,  # noqa: ANN401
+    ports: list[int] | None = None,
+    schemes: list[str] | None = None,
+    timeout: int = 10,  # noqa: ASYNC109
+) -> aiohttp.ClientResponse:
+    validate_url(
+        url,
+        ascii_only=ascii_only,
+        enforce_sanitization=enforce_sanitization,
+        ports=ports or [],
+        schemes=schemes or [],
+    )
+    connector = (
+        get_secure_connector(
+            allow_local_network=allow_local_network,
+            allow_localhost=allow_localhost,
+        )
+        if dns_rebind_protection
+        else aiohttp.TCPConnector
+    )
+    connection = connector(
+        ssl=ssl.create_default_context(cafile=certifi.where()),
+    )
+
+    async with (
+        aiohttp.ClientSession(
+            connector=connection,
+            headers=headers,
+        ) as session,
+        session.request(
+            method,
+            url,
+            allow_redirects=not dns_rebind_protection,
+            json=json,
+            timeout=aiohttp.ClientTimeout(total=timeout),
+        ) as response,
+    ):
+        await response.read()
+        return response

fluidattacks_core_http-12.0.0/fluidattacks_core/http/validations.py

@@ -0,0 +1,133 @@
+import html
+import ipaddress
+
+from urllib3.exceptions import LocationParseError
+from urllib3.util import Url, parse_url
+
+
+class HTTPValidationError(Exception):
+    pass
+
+
+def validate_scheme(scheme: str | None, schemes: list[str]) -> None:
+    if scheme and scheme not in schemes:
+        msg = f"Only allowed schemes are {', '.join(schemes)}"
+        raise HTTPValidationError(msg)
+
+
+def validate_port(port: int | None, ports: list[int]) -> None:
+    if port and port < 1024 and port not in ports:
+        msg = f"Only allowed ports are {', '.join(map(str, ports))}, and any over 1024"
+        raise HTTPValidationError(msg)
+
+
+def validate_host(host: str | None) -> None:
+    if not host:
+        return
+    try:
+        ipaddress.ip_address(host)
+    except ValueError:
+        if host[0].isalnum():
+            return
+    else:
+        return
+    msg = "Hostname or IP address invalid"
+    raise HTTPValidationError(msg)
+
+
+def validate_unicode_restriction(uri: Url) -> None:
+    uri_str = str(uri)
+    if not uri_str.isascii():
+        msg = f"URI must be ascii only {uri_str}"
+        raise HTTPValidationError(msg)
+
+
+def validate_html_tags(uri: Url) -> None:
+    uri_str = str(uri)
+    sanitized_uri = html.escape(uri_str)
+    if sanitized_uri != uri_str:
+        msg = "HTML/CSS/JS tags are not allowed"
+        raise HTTPValidationError(msg)
+
+
+def validate_url(
+    url: str,
+    *,
+    ascii_only: bool,
+    enforce_sanitization: bool,
+    ports: list[int],
+    schemes: list[str],
+) -> None:
+    try:
+        uri = parse_url(url)
+    except LocationParseError as exc:
+        msg = f"Invalid URL {url}"
+        raise HTTPValidationError(msg) from exc
+    validate_host(uri.host)
+
+    if ascii_only:
+        validate_unicode_restriction(uri)
+    if enforce_sanitization:
+        validate_html_tags(uri)
+    if ports:
+        validate_port(uri.port, ports)
+    if schemes:
+        validate_scheme(uri.scheme, schemes)
+
+
+def validate_loopback(
+    ips: list[ipaddress.IPv4Address | ipaddress.IPv6Address],
+) -> None:
+    if any(ip.is_loopback for ip in ips):
+        msg = "Requests to loopback addresses are not allowed"
+        raise HTTPValidationError(msg)
+
+
+def validate_local_network(
+    ips: list[ipaddress.IPv4Address | ipaddress.IPv6Address],
+) -> None:
+    if any(ip.is_private for ip in ips):
+        msg = "Requests to the local network are not allowed"
+        raise HTTPValidationError(msg)
+
+
+def validate_link_local(
+    ips: list[ipaddress.IPv4Address | ipaddress.IPv6Address],
+) -> None:
+    if any(ip.is_link_local for ip in ips):
+        msg = "Requests to the link local network are not allowed"
+        raise HTTPValidationError(msg)
+
+
+def validate_shared_address(
+    ips: list[ipaddress.IPv4Address | ipaddress.IPv6Address],
+) -> None:
+    shared_address_space = ipaddress.ip_network("100.64.0.0/10")
+    if any(ip in shared_address_space for ip in ips):
+        msg = "Requests to the shared address space are not allowed"
+        raise HTTPValidationError(msg)
+
+
+def validate_limited_broadcast_address(
+    ips: list[ipaddress.IPv4Address | ipaddress.IPv6Address],
+) -> None:
+    limited_broadcast_address = ipaddress.ip_address("255.255.255.255")
+    if any(ip == limited_broadcast_address for ip in ips):
+        msg = "Requests to the limited broadcast address are not allowed"
+        raise HTTPValidationError(msg)
+
+
+def validate_local_request(
+    ips: list[ipaddress.IPv4Address | ipaddress.IPv6Address],
+    *,
+    allow_local_network: bool,
+    allow_localhost: bool,
+) -> None:
+    if not allow_localhost:
+        validate_loopback(ips)
+
+    if not allow_local_network:
+        validate_local_network(ips)
+        validate_link_local(ips)
+        validate_shared_address(ips)
+        validate_limited_broadcast_address(ips)

fluidattacks_core_http-12.0.0/import-linter.cfg

@@ -0,0 +1,22 @@
+[importlinter]
+  root_package = fluidattacks_core
+  include_external_packages = True
+
+[importlinter:contract:portion]
+  name = Single Portion
+  type = layers
+  containers =
+    fluidattacks_core
+  exhaustive = true
+  layers =
+    http
+
+[importlinter:contract:dag]
+  name = Direct Acyclic Graph
+  type = layers
+  containers =
+    fluidattacks_core.http
+  exhaustive = true
+  layers =
+    client
+    validations

fluidattacks_core_http-12.0.0/mypy.ini

@@ -0,0 +1,32 @@
+[mypy]
+disallow_any_decorated = True
+disallow_any_expr = False
+disallow_any_explicit = False
+disallow_any_generics = True
+disallow_any_unimported = True
+disallow_incomplete_defs = True
+disallow_subclassing_any = True
+disallow_untyped_calls = True
+disallow_untyped_decorators = True
+disallow_untyped_defs = True
+
+check_untyped_defs = True
+no_implicit_optional = True
+strict = True
+strict_equality = True
+strict_optional = True
+
+warn_redundant_casts = True
+warn_unused_ignores = True
+warn_no_return = True
+warn_return_any = False
+warn_unreachable = True
+
+explicit_package_bases = True
+
+ignore_errors = False
+ignore_missing_imports = False
+allow_untyped_globals = False
+allow_redefinition = False
+local_partial_types = False
+implicit_reexport = False