fluidattacks_core_http 12.0.0__tar.gz → 12.1.0__tar.gz

{fluidattacks_core_http-12.0.0 → fluidattacks_core_http-12.1.0}/.gitignore

@@ -1,5 +1,9 @@
+dist/
+dist-*/
+/.cargo-cache
 target/
 .direnv/
 .venv/
 .vscode/settings.json
 .zed/settings.json
+*.so

{fluidattacks_core_http-12.0.0 → fluidattacks_core_http-12.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: fluidattacks_core_http
-Version: 12.0.0
+Version: 12.1.0
 Summary: Fluid Attacks Core HTTP Library
 Author-email: Development <development@fluidattacks.com>
 License: MPL-2.0

{fluidattacks_core_http-12.0.0 → fluidattacks_core_http-12.1.0}/build/default.nix

@@ -9,7 +9,6 @@
   override = {
     checks = {
       basedpyright = false;
-      pytest = false;
     };
     configs = {
       import_linter = ../import-linter.cfg;

{fluidattacks_core_http-12.0.0 → fluidattacks_core_http-12.1.0}/build/filter.nix

@@ -3,6 +3,7 @@ path_filter {
   root = src;
   include = [
     "fluidattacks_core"
+    "tests"
     "import-linter.cfg"
     "mypy.ini"
     "pyproject.toml"

fluidattacks_core_http-12.1.0/fluidattacks_core/http/client.py

@@ -0,0 +1,158 @@
+import ipaddress
+import ssl
+from collections.abc import Sequence
+from typing import (
+    Any,
+    Literal,
+)
+from urllib.parse import urljoin
+
+import aiohttp
+import certifi
+
+from .validations import (
+    validate_local_request,
+    validate_url,
+)
+
+_MAX_REDIRECTS = 10
+_METHODS_SWITCH_TO_GET = frozenset({301, 302, 303})
+
+
+def get_secure_connector(
+    *,
+    allow_local_network: bool,
+    allow_localhost: bool,
+) -> type[aiohttp.TCPConnector]:
+    class SecureTCPConnector(aiohttp.TCPConnector):
+        async def _resolve_host(
+            self,
+            host: str,
+            port: int,
+            traces: Sequence[aiohttp.tracing.Trace] | None = None,
+        ) -> list[aiohttp.abc.ResolveResult]:
+            hosts = await super()._resolve_host(host, port, traces)
+            resolved_ips = [ipaddress.ip_address(host["host"]) for host in hosts]
+            validate_local_request(
+                resolved_ips,
+                allow_local_network=allow_local_network,
+                allow_localhost=allow_localhost,
+            )
+            return hosts
+
+    return SecureTCPConnector
+
+
+async def request(  # noqa: PLR0913
+    url: str,
+    *,
+    method: Literal["GET", "POST", "PUT", "PATCH", "DELETE"],
+    allow_local_network: bool = False,
+    allow_localhost: bool = False,
+    allow_redirects: bool | None = None,
+    ascii_only: bool = False,
+    dns_rebind_protection: bool = True,
+    enforce_sanitization: bool = False,
+    headers: dict[str, str] | None = None,
+    json: Any | None = None,  # noqa: ANN401
+    ports: list[int] | None = None,
+    schemes: list[str] | None = None,
+    timeout: int = 10,  # noqa: ASYNC109
+) -> aiohttp.ClientResponse:
+    validate_url(
+        url,
+        ascii_only=ascii_only,
+        enforce_sanitization=enforce_sanitization,
+        ports=ports or [],
+        schemes=schemes or [],
+    )
+    connector = (
+        get_secure_connector(
+            allow_local_network=allow_local_network,
+            allow_localhost=allow_localhost,
+        )
+        if dns_rebind_protection
+        else aiohttp.TCPConnector
+    )
+    connection = connector(
+        ssl=ssl.create_default_context(cafile=certifi.where()),
+    )
+    if allow_redirects is True:
+        return await _request_with_validated_redirects(
+            connection=connection,
+            headers=headers,
+            initial_url=url,
+            initial_method=method,
+            json=json,
+            timeout=timeout,
+            validation_options={
+                "ascii_only": ascii_only,
+                "enforce_sanitization": enforce_sanitization,
+                "ports": ports or [],
+                "schemes": schemes or [],
+            },
+        )
+    aiohttp_follow = allow_redirects if allow_redirects is not None else not dns_rebind_protection
+
+    async with (
+        aiohttp.ClientSession(
+            connector=connection,
+            headers=headers,
+        ) as session,
+        session.request(
+            method,
+            url,
+            allow_redirects=aiohttp_follow,
+            json=json,
+            timeout=aiohttp.ClientTimeout(total=timeout),
+        ) as response,
+    ):
+        await response.read()
+        return response
+
+
+async def _request_with_validated_redirects(  # noqa: PLR0913
+    *,
+    connection: aiohttp.BaseConnector,
+    headers: dict[str, str] | None,
+    initial_url: str,
+    initial_method: Literal["GET", "POST", "PUT", "PATCH", "DELETE"],
+    json: Any,  # noqa: ANN401
+    timeout: int,  # noqa: ASYNC109
+    validation_options: dict[str, Any],
+) -> aiohttp.ClientResponse:
+    """Follow redirects manually so validate_url runs on every hop.
+
+    aiohttp's ``allow_redirects=True`` short-circuits our
+    scheme/port/ascii/sanitization checks after the first hop, letting a
+    compromised server redirect to a target the caller had restricted.
+    """
+    current_url = initial_url
+    current_method: Literal["GET", "POST", "PUT", "PATCH", "DELETE"] = initial_method
+    current_json: Any = json
+    async with aiohttp.ClientSession(connector=connection, headers=headers) as session:
+        for _ in range(_MAX_REDIRECTS + 1):
+            async with session.request(
+                current_method,
+                current_url,
+                allow_redirects=False,
+                json=current_json,
+                timeout=aiohttp.ClientTimeout(total=timeout),
+            ) as response:
+                await response.read()
+            status = response.status
+            location = response.headers.get("Location")
+            if not (300 <= status < 400) or location is None:
+                return response
+            current_url = urljoin(current_url, location)
+            validate_url(current_url, **validation_options)
+            if status in _METHODS_SWITCH_TO_GET:
+                current_method = "GET"
+                current_json = None
+        raise aiohttp.TooManyRedirects(
+            response.request_info,
+            (),
+            message=(
+                f"exceeded {_MAX_REDIRECTS} redirects, aborted before requesting {current_url}"
+            ),
+        )

{fluidattacks_core_http-12.0.0 → fluidattacks_core_http-12.1.0}/import-linter.cfg

@@ -1,16 +1,7 @@
 [importlinter]
-  root_package = fluidattacks_core
+  root_package = fluidattacks_core.http
   include_external_packages = True
 
-[importlinter:contract:portion]
-  name = Single Portion
-  type = layers
-  containers =
-    fluidattacks_core
-  exhaustive = true
-  layers =
-    http
-
 [importlinter:contract:dag]
   name = Direct Acyclic Graph
   type = layers

{fluidattacks_core_http-12.0.0 → fluidattacks_core_http-12.1.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fluidattacks_core_http"
-version = "12.0.0"
+version = "12.1.0"
 description = "Fluid Attacks Core HTTP Library"
 authors = [{ name = "Development", email = "development@fluidattacks.com" }]
 license = { text = "MPL-2.0" }
@@ -24,6 +24,8 @@ dev = [
   "deptry>=0.23.1",
   "import-linter==2.11",
   "mypy==1.19.1",
+  "pytest==9.0.3",
+  "pytest-asyncio>=1.1.0",
   "ruff==0.15.0",
 ]
 

fluidattacks_core_http-12.1.0/tests/__init__.py

@@ -0,0 +1 @@
+"""Tests for fluidattacks_core.http."""

fluidattacks_core_http-12.1.0/tests/test_client.py

@@ -0,0 +1,239 @@
+"""Tests for fluidattacks_core.http.client.request."""
+
+from collections.abc import Awaitable, Callable
+
+import aiohttp
+import pytest
+from aiohttp import web
+from aiohttp.test_utils import TestServer
+
+from fluidattacks_core.http import request
+from fluidattacks_core.http.validations import HTTPValidationError
+
+RouteHandler = Callable[[web.Request], Awaitable[web.StreamResponse]]
+
+
+async def _build_server(routes: dict[str, RouteHandler]) -> TestServer:
+    app = web.Application()
+    for path, handler in routes.items():
+        app.router.add_get(path, handler)
+        app.router.add_post(path, handler)
+    server = TestServer(app)
+    await server.start_server()
+    return server
+
+
+async def _permissive_request(
+    url: str,
+    *,
+    method: str = "GET",
+    allow_redirects: bool | None = None,
+    schemes: list[str] | None = None,
+    ports: list[int] | None = None,
+    json: object | None = None,
+) -> aiohttp.ClientResponse:
+    """Wrapper that turns off protections irrelevant to redirect-logic tests."""
+    return await request(
+        url,
+        method=method,  # type: ignore[arg-type]
+        allow_redirects=allow_redirects,
+        allow_local_network=True,
+        allow_localhost=True,
+        dns_rebind_protection=False,
+        schemes=schemes,
+        ports=ports,
+        json=json,
+    )
+
+
+def _make_server_url(server: TestServer, path: str) -> str:
+    return f"http://{server.host}:{server.port}{path}"
+
+
+@pytest.mark.asyncio
+async def test_allow_redirects_default_does_not_follow_when_rebind_protected() -> None:
+    hits: list[str] = []
+
+    async def handle_start(_req: web.Request) -> web.Response:
+        hits.append("start")
+        return web.Response(status=301, headers={"Location": "/final"})
+
+    async def handle_final(_req: web.Request) -> web.Response:
+        hits.append("final")
+        return web.Response(status=200)
+
+    server = await _build_server({"/start": handle_start, "/final": handle_final})
+    try:
+        response = await request(
+            _make_server_url(server, "/start"),
+            method="GET",
+            allow_local_network=True,
+            allow_localhost=True,
+        )
+        assert response.status == 301
+        assert hits == ["start"]
+    finally:
+        await server.close()
+
+
+@pytest.mark.asyncio
+async def test_allow_redirects_default_follows_when_rebind_disabled() -> None:
+    async def handle_start(_req: web.Request) -> web.Response:
+        return web.Response(status=301, headers={"Location": "/final"})
+
+    async def handle_final(_req: web.Request) -> web.Response:
+        return web.Response(status=200)
+
+    server = await _build_server({"/start": handle_start, "/final": handle_final})
+    try:
+        response = await _permissive_request(_make_server_url(server, "/start"))
+        assert response.status == 200
+    finally:
+        await server.close()
+
+
+@pytest.mark.asyncio
+async def test_allow_redirects_false_never_follows() -> None:
+    async def handle_start(_req: web.Request) -> web.Response:
+        return web.Response(status=301, headers={"Location": "/final"})
+
+    async def handle_final(_req: web.Request) -> web.Response:
+        return web.Response(status=200)
+
+    server = await _build_server({"/start": handle_start, "/final": handle_final})
+    try:
+        response = await _permissive_request(
+            _make_server_url(server, "/start"), allow_redirects=False
+        )
+        assert response.status == 301
+    finally:
+        await server.close()
+
+
+@pytest.mark.asyncio
+async def test_allow_redirects_true_follows_canonical_chain_to_2xx() -> None:
+    async def handle_start(_req: web.Request) -> web.Response:
+        return web.Response(status=301, headers={"Location": "/final"})
+
+    async def handle_final(_req: web.Request) -> web.Response:
+        return web.Response(status=200, text="ok")
+
+    server = await _build_server({"/start": handle_start, "/final": handle_final})
+    try:
+        response = await _permissive_request(
+            _make_server_url(server, "/start"), allow_redirects=True
+        )
+        assert response.status == 200
+        assert await response.text() == "ok"
+    finally:
+        await server.close()
+
+
+@pytest.mark.asyncio
+async def test_allow_redirects_true_validates_scheme_on_redirect_target() -> None:
+    async def handle_start(_req: web.Request) -> web.Response:
+        return web.Response(
+            status=302, headers={"Location": "ftp://outside.example.com/attack"}
+        )
+
+    server = await _build_server({"/start": handle_start})
+    try:
+        with pytest.raises(HTTPValidationError):
+            await _permissive_request(
+                _make_server_url(server, "/start"),
+                allow_redirects=True,
+                schemes=["http"],
+            )
+    finally:
+        await server.close()
+
+
+@pytest.mark.asyncio
+async def test_allow_redirects_true_validates_port_on_redirect_target() -> None:
+    async def handle_start(_req: web.Request) -> web.Response:
+        return web.Response(
+            status=302,
+            headers={"Location": "http://outside.example.com:22/attack"},
+        )
+
+    server = await _build_server({"/start": handle_start})
+    try:
+        with pytest.raises(HTTPValidationError):
+            await _permissive_request(
+                _make_server_url(server, "/start"),
+                allow_redirects=True,
+                ports=[80, 443],
+            )
+    finally:
+        await server.close()
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("status", [301, 302, 303])
+async def test_status_rewrites_follow_up_method_to_get(status: int) -> None:
+    methods: list[str] = []
+
+    async def handle_start(req: web.Request) -> web.Response:
+        methods.append(req.method)
+        return web.Response(status=status, headers={"Location": "/final"})
+
+    async def handle_final(req: web.Request) -> web.Response:
+        methods.append(req.method)
+        return web.Response(status=200)
+
+    server = await _build_server({"/start": handle_start, "/final": handle_final})
+    try:
+        response = await _permissive_request(
+            _make_server_url(server, "/start"),
+            method="POST",
+            allow_redirects=True,
+            json={"payload": "value"},
+        )
+        assert response.status == 200
+        assert methods == ["POST", "GET"]
+    finally:
+        await server.close()
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("status", [307, 308])
+async def test_status_preserves_follow_up_method(status: int) -> None:
+    methods: list[str] = []
+
+    async def handle_start(req: web.Request) -> web.Response:
+        methods.append(req.method)
+        return web.Response(status=status, headers={"Location": "/final"})
+
+    async def handle_final(req: web.Request) -> web.Response:
+        methods.append(req.method)
+        return web.Response(status=200)
+
+    server = await _build_server({"/start": handle_start, "/final": handle_final})
+    try:
+        response = await _permissive_request(
+            _make_server_url(server, "/start"),
+            method="POST",
+            allow_redirects=True,
+            json={"payload": "value"},
+        )
+        assert response.status == 200
+        assert methods == ["POST", "POST"]
+    finally:
+        await server.close()
+
+
+@pytest.mark.asyncio
+async def test_exceeding_max_redirects_raises_too_many_redirects() -> None:
+    async def handle_hop(req: web.Request) -> web.Response:
+        return web.Response(
+            status=301, headers={"Location": f"/hop?n={req.query.get('n', '0')}"}
+        )
+
+    server = await _build_server({"/hop": handle_hop})
+    try:
+        with pytest.raises(aiohttp.TooManyRedirects):
+            await _permissive_request(
+                _make_server_url(server, "/hop?n=0"), allow_redirects=True
+            )
+    finally:
+        await server.close()

{fluidattacks_core_http-12.0.0 → fluidattacks_core_http-12.1.0}/uv.lock

@@ -217,7 +217,7 @@ wheels = [
 
 [[package]]
 name = "fluidattacks-core-http"
-version = "12.0.0"
+version = "12.1.0"
 source = { editable = "." }
 dependencies = [
     { name = "aiohttp" },
@@ -230,6 +230,8 @@ dev = [
     { name = "deptry" },
     { name = "import-linter" },
     { name = "mypy" },
+    { name = "pytest" },
+    { name = "pytest-asyncio" },
     { name = "ruff" },
 ]
 
@@ -245,6 +247,8 @@ dev = [
     { name = "deptry", specifier = ">=0.23.1" },
     { name = "import-linter", specifier = "==2.11" },
     { name = "mypy", specifier = "==1.19.1" },
+    { name = "pytest", specifier = "==9.0.3" },
+    { name = "pytest-asyncio", specifier = ">=1.1.0" },
     { name = "ruff", specifier = "==0.15.0" },
 ]
 
@@ -465,6 +469,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/e9/aa/2ed2c89543632ded7196e0d93dcc6c7fe87769e88391a648c4a298ea864a/import_linter-2.11-py3-none-any.whl", hash = "sha256:3dc54cae933bae3430358c30989762b721c77aa99d424f56a08265be0eeaa465", size = 637315, upload-time = "2026-03-06T12:11:36.599Z" },
 ]
 
+[[package]]
+name = "iniconfig"
+version = "2.3.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/72/34/14ca021ce8e5dfedc35312d08ba8bf51fdd999c576889fc2c24cb97f4f10/iniconfig-2.3.0.tar.gz", hash = "sha256:c76315c77db068650d49c5b56314774a7804df16fee4402c1f19d6d15d8c4730", size = 20503, upload-time = "2025-10-18T21:55:43.219Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/cb/b1/3846dd7f199d53cb17f49cba7e651e9ce294d8497c8c150530ed11865bb8/iniconfig-2.3.0-py3-none-any.whl", hash = "sha256:f631c04d2c48c52b84d0d0549c99ff3859c98df65b3101406327ecc7d53fbf12", size = 7484, upload-time = "2025-10-18T21:55:41.639Z" },
+]
+
 [[package]]
 name = "librt"
 version = "0.13.0"
@@ -744,6 +757,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/f1/d9/7fb5aa316bc299258e68c73ba3bddbc499654a07f151cba08f6153988714/pathspec-1.1.1-py3-none-any.whl", hash = "sha256:a00ce642f577bf7f473932318056212bc4f8bfdf53128c78bbd5af0b9b20b189", size = 57328, upload-time = "2026-04-27T01:46:07.06Z" },
 ]
 
+[[package]]
+name = "pluggy"
+version = "1.6.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f9/e2/3e91f31a7d2b083fe6ef3fa267035b518369d9511ffab804f839851d2779/pluggy-1.6.0.tar.gz", hash = "sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3", size = 69412, upload-time = "2025-05-15T12:30:07.975Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/54/20/4d324d65cc6d9205fabedc306948156824eb9f0ee1633355a8f7ec5c66bf/pluggy-1.6.0-py3-none-any.whl", hash = "sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746", size = 20538, upload-time = "2025-05-15T12:30:06.134Z" },
+]
+
 [[package]]
 name = "propcache"
 version = "0.5.2"
@@ -864,6 +886,35 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/f4/7e/a72dd26f3b0f4f2bf1dd8923c85f7ceb43172af56d63c7383eb62b332364/pygments-2.20.0-py3-none-any.whl", hash = "sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176", size = 1231151, upload-time = "2026-03-29T13:29:30.038Z" },
 ]
 
+[[package]]
+name = "pytest"
+version = "9.0.3"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+    { name = "iniconfig" },
+    { name = "packaging" },
+    { name = "pluggy" },
+    { name = "pygments" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/7d/0d/549bd94f1a0a402dc8cf64563a117c0f3765662e2e668477624baeec44d5/pytest-9.0.3.tar.gz", hash = "sha256:b86ada508af81d19edeb213c681b1d48246c1a91d304c6c81a427674c17eb91c", size = 1572165, upload-time = "2026-04-07T17:16:18.027Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d4/24/a372aaf5c9b7208e7112038812994107bc65a84cd00e0354a88c2c77a617/pytest-9.0.3-py3-none-any.whl", hash = "sha256:2c5efc453d45394fdd706ade797c0a81091eccd1d6e4bccfcd476e2b8e0ab5d9", size = 375249, upload-time = "2026-04-07T17:16:16.13Z" },
+]
+
+[[package]]
+name = "pytest-asyncio"
+version = "1.4.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pytest" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/43/7c/d36d04db312ecf4298932ef77e6e4a9e8ad017906e24e34f0b0c361a2473/pytest_asyncio-1.4.0.tar.gz", hash = "sha256:c6c0d2259945122819f171a32ecea2c349ead889ee28176caaf492143424be42", size = 58514, upload-time = "2026-05-26T09:56:04.083Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/03/e2/08a497ef684b88559c9cc5f4ad53a37e7b99e727094a86d6ea32536d5d3c/pytest_asyncio-1.4.0-py3-none-any.whl", hash = "sha256:933ca923a23075a87fb7070c0ec272a6848489824d887c85c812670932835aa1", size = 16930, upload-time = "2026-05-26T09:56:02.576Z" },
+]
+
 [[package]]
 name = "requirements-parser"
 version = "0.13.1"

fluidattacks_core_http-12.0.0/fluidattacks_core/http/client.py

@@ -1,90 +0,0 @@
-import ipaddress
-import ssl
-from collections.abc import Sequence
-from typing import (
-    Any,
-    Literal,
-)
-
-import aiohttp
-import certifi
-
-from .validations import (
-    validate_local_request,
-    validate_url,
-)
-
-
-def get_secure_connector(
-    *,
-    allow_local_network: bool,
-    allow_localhost: bool,
-) -> type[aiohttp.TCPConnector]:
-    class SecureTCPConnector(aiohttp.TCPConnector):
-        async def _resolve_host(
-            self,
-            host: str,
-            port: int,
-            traces: Sequence[aiohttp.tracing.Trace] | None = None,
-        ) -> list[aiohttp.abc.ResolveResult]:
-            hosts = await super()._resolve_host(host, port, traces)
-            resolved_ips = [ipaddress.ip_address(host["host"]) for host in hosts]
-            validate_local_request(
-                resolved_ips,
-                allow_local_network=allow_local_network,
-                allow_localhost=allow_localhost,
-            )
-            return hosts
-
-    return SecureTCPConnector
-
-
-async def request(  # noqa: PLR0913
-    url: str,
-    *,
-    method: Literal["GET", "POST", "PUT", "PATCH", "DELETE"],
-    allow_local_network: bool = False,
-    allow_localhost: bool = False,
-    ascii_only: bool = False,
-    dns_rebind_protection: bool = True,
-    enforce_sanitization: bool = False,
-    headers: dict[str, str] | None = None,
-    json: Any | None = None,  # noqa: ANN401
-    ports: list[int] | None = None,
-    schemes: list[str] | None = None,
-    timeout: int = 10,  # noqa: ASYNC109
-) -> aiohttp.ClientResponse:
-    validate_url(
-        url,
-        ascii_only=ascii_only,
-        enforce_sanitization=enforce_sanitization,
-        ports=ports or [],
-        schemes=schemes or [],
-    )
-    connector = (
-        get_secure_connector(
-            allow_local_network=allow_local_network,
-            allow_localhost=allow_localhost,
-        )
-        if dns_rebind_protection
-        else aiohttp.TCPConnector
-    )
-    connection = connector(
-        ssl=ssl.create_default_context(cafile=certifi.where()),
-    )
-
-    async with (
-        aiohttp.ClientSession(
-            connector=connection,
-            headers=headers,
-        ) as session,
-        session.request(
-            method,
-            url,
-            allow_redirects=not dns_rebind_protection,
-            json=json,
-            timeout=aiohttp.ClientTimeout(total=timeout),
-        ) as response,
-    ):
-        await response.read()
-        return response