fluidattacks_core_http 12.0.0__tar.gz → 12.2.0__tar.gz

{fluidattacks_core_http-12.0.0 → fluidattacks_core_http-12.2.0}/.gitignore

@@ -1,5 +1,9 @@
+dist/
+dist-*/
+/.cargo-cache
 target/
 .direnv/
 .venv/
 .vscode/settings.json
 .zed/settings.json
+*.so

{fluidattacks_core_http-12.0.0 → fluidattacks_core_http-12.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: fluidattacks_core_http
-Version: 12.0.0
+Version: 12.2.0
 Summary: Fluid Attacks Core HTTP Library
 Author-email: Development <development@fluidattacks.com>
 License: MPL-2.0

fluidattacks_core_http-12.2.0/fluidattacks_core/http/__init__.py

@@ -0,0 +1,7 @@
+from .client import (
+    MAX_RESPONSE_BYTES,
+    ResponseTooLargeError,
+    request,
+)
+
+__all__ = ["MAX_RESPONSE_BYTES", "ResponseTooLargeError", "request"]

fluidattacks_core_http-12.2.0/fluidattacks_core/http/client.py

@@ -0,0 +1,211 @@
+import ipaddress
+import ssl
+from collections.abc import Sequence
+from contextvars import ContextVar
+from typing import (
+    Any,
+    Literal,
+)
+from urllib.parse import urljoin
+
+import aiohttp
+import certifi
+
+from .validations import (
+    validate_local_request,
+    validate_url,
+)
+
+_MAX_REDIRECTS = 10
+_METHODS_SWITCH_TO_GET = frozenset({301, 302, 303})
+_READ_CHUNK_BYTES = 64 * 1024
+
+# Bounds each response so that no single request can exhaust the pod.
+MAX_RESPONSE_BYTES = 64 * 1024 * 1024
+
+# aiohttp builds the response object, so the caller's cap cannot be passed to
+# it directly.
+_CAP: ContextVar[int] = ContextVar("max_response_bytes", default=MAX_RESPONSE_BYTES)
+
+
+class ResponseTooLargeError(aiohttp.ClientPayloadError):
+    pass
+
+
+class BoundedResponse(aiohttp.ClientResponse):
+    async def read(self) -> bytes:
+        if self._body is None:
+            max_response_bytes = _CAP.get()
+            try:
+                self._reject_oversized_content_length(max_response_bytes)
+                self._body = await self._accumulate_capped(max_response_bytes)
+            except BaseException:
+                self.close()
+                raise
+        # Deferring to the parent awaits the request writer through internals
+        # a subclass cannot name.
+        return await super().read()
+
+    def _reject_oversized_content_length(self, max_response_bytes: int) -> None:
+        declared = self.content_length
+        if declared is not None and declared > max_response_bytes:
+            msg = f"Response declares {declared} bytes, over the {max_response_bytes} limit"
+            raise ResponseTooLargeError(msg)
+
+    async def _accumulate_capped(self, max_response_bytes: int) -> bytes:
+        # Counting decoded bytes as they arrive is the only bound that
+        # survives a compressed or chunked body, where the declared length
+        # says nothing about what decoding produces.
+        body = bytearray()
+        async for chunk in self.content.iter_chunked(_READ_CHUNK_BYTES):
+            body.extend(chunk)
+            if len(body) > max_response_bytes:
+                msg = f"Response exceeds the {max_response_bytes} byte limit"
+                raise ResponseTooLargeError(msg)
+        return bytes(body)
+
+
+def get_secure_connector(
+    *,
+    allow_local_network: bool,
+    allow_localhost: bool,
+) -> type[aiohttp.TCPConnector]:
+    class SecureTCPConnector(aiohttp.TCPConnector):
+        async def _resolve_host(
+            self,
+            host: str,
+            port: int,
+            traces: Sequence[aiohttp.tracing.Trace] | None = None,
+        ) -> list[aiohttp.abc.ResolveResult]:
+            hosts = await super()._resolve_host(host, port, traces)
+            resolved_ips = [ipaddress.ip_address(host["host"]) for host in hosts]
+            validate_local_request(
+                resolved_ips,
+                allow_local_network=allow_local_network,
+                allow_localhost=allow_localhost,
+            )
+            return hosts
+
+    return SecureTCPConnector
+
+
+async def request(  # noqa: PLR0913
+    url: str,
+    *,
+    method: Literal["GET", "POST", "PUT", "PATCH", "DELETE"],
+    allow_local_network: bool = False,
+    allow_localhost: bool = False,
+    allow_redirects: bool | None = None,
+    ascii_only: bool = False,
+    dns_rebind_protection: bool = True,
+    enforce_sanitization: bool = False,
+    headers: dict[str, str] | None = None,
+    json: Any | None = None,  # noqa: ANN401
+    max_response_bytes: int = MAX_RESPONSE_BYTES,
+    ports: list[int] | None = None,
+    schemes: list[str] | None = None,
+    timeout: int = 10,  # noqa: ASYNC109
+) -> aiohttp.ClientResponse:
+    validate_url(
+        url,
+        ascii_only=ascii_only,
+        enforce_sanitization=enforce_sanitization,
+        ports=ports or [],
+        schemes=schemes or [],
+    )
+    connector = (
+        get_secure_connector(
+            allow_local_network=allow_local_network,
+            allow_localhost=allow_localhost,
+        )
+        if dns_rebind_protection
+        else aiohttp.TCPConnector
+    )
+    connection = connector(
+        ssl=ssl.create_default_context(cafile=certifi.where()),
+    )
+    _CAP.set(max_response_bytes)
+    if allow_redirects is True:
+        return await _request_with_validated_redirects(
+            connection=connection,
+            headers=headers,
+            initial_url=url,
+            initial_method=method,
+            json=json,
+            timeout=timeout,
+            validation_options={
+                "ascii_only": ascii_only,
+                "enforce_sanitization": enforce_sanitization,
+                "ports": ports or [],
+                "schemes": schemes or [],
+            },
+        )
+    aiohttp_follow = allow_redirects if allow_redirects is not None else not dns_rebind_protection
+
+    async with (
+        aiohttp.ClientSession(
+            connector=connection,
+            headers=headers,
+            response_class=BoundedResponse,
+        ) as session,
+        session.request(
+            method,
+            url,
+            allow_redirects=aiohttp_follow,
+            json=json,
+            timeout=aiohttp.ClientTimeout(total=timeout),
+        ) as response,
+    ):
+        await response.read()
+        return response
+
+
+async def _request_with_validated_redirects(  # noqa: PLR0913
+    *,
+    connection: aiohttp.BaseConnector,
+    headers: dict[str, str] | None,
+    initial_url: str,
+    initial_method: Literal["GET", "POST", "PUT", "PATCH", "DELETE"],
+    json: Any,  # noqa: ANN401
+    timeout: int,  # noqa: ASYNC109
+    validation_options: dict[str, Any],
+) -> aiohttp.ClientResponse:
+    """Follow redirects manually so validate_url runs on every hop.
+
+    aiohttp's ``allow_redirects=True`` short-circuits our
+    scheme/port/ascii/sanitization checks after the first hop, letting a
+    compromised server redirect to a target the caller had restricted.
+    """
+    current_url = initial_url
+    current_method: Literal["GET", "POST", "PUT", "PATCH", "DELETE"] = initial_method
+    current_json: Any = json
+    async with aiohttp.ClientSession(
+        connector=connection,
+        headers=headers,
+        response_class=BoundedResponse,
+    ) as session:
+        for _ in range(_MAX_REDIRECTS + 1):
+            async with session.request(
+                current_method,
+                current_url,
+                allow_redirects=False,
+                json=current_json,
+                timeout=aiohttp.ClientTimeout(total=timeout),
+            ) as response:
+                await response.read()
+            status = response.status
+            location = response.headers.get("Location")
+            if not (300 <= status < 400) or location is None:
+                return response
+            current_url = urljoin(current_url, location)
+            validate_url(current_url, **validation_options)
+            if status in _METHODS_SWITCH_TO_GET:
+                current_method = "GET"
+                current_json = None
+        raise aiohttp.TooManyRedirects(
+            response.request_info,
+            (),
+            message=(
+                f"exceeded {_MAX_REDIRECTS} redirects, aborted before requesting {current_url}"
+            ),
+        )

{fluidattacks_core_http-12.0.0 → fluidattacks_core_http-12.2.0}/fluidattacks_core/http/validations.py

@@ -10,7 +10,7 @@ class HTTPValidationError(Exception):
 
 
 def validate_scheme(scheme: str | None, schemes: list[str]) -> None:
-    if scheme and scheme not in schemes:
+    if scheme not in schemes:
         msg = f"Only allowed schemes are {', '.join(schemes)}"
         raise HTTPValidationError(msg)
 

{fluidattacks_core_http-12.0.0 → fluidattacks_core_http-12.2.0}/import-linter.cfg

@@ -1,16 +1,7 @@
 [importlinter]
-  root_package = fluidattacks_core
+  root_package = fluidattacks_core.http
   include_external_packages = True
 
-[importlinter:contract:portion]
-  name = Single Portion
-  type = layers
-  containers =
-    fluidattacks_core
-  exhaustive = true
-  layers =
-    http
-
 [importlinter:contract:dag]
   name = Direct Acyclic Graph
   type = layers

{fluidattacks_core_http-12.0.0 → fluidattacks_core_http-12.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fluidattacks_core_http"
-version = "12.0.0"
+version = "12.2.0"
 description = "Fluid Attacks Core HTTP Library"
 authors = [{ name = "Development", email = "development@fluidattacks.com" }]
 license = { text = "MPL-2.0" }
@@ -24,6 +24,8 @@ dev = [
   "deptry>=0.23.1",
   "import-linter==2.11",
   "mypy==1.19.1",
+  "pytest==9.0.3",
+  "pytest-asyncio>=1.1.0",
   "ruff==0.15.0",
 ]
 

fluidattacks_core_http-12.2.0/tests/__init__.py

@@ -0,0 +1 @@
+"""Tests for fluidattacks_core.http."""

fluidattacks_core_http-12.2.0/tests/test_client.py

@@ -0,0 +1,459 @@
+"""Tests for fluidattacks_core.http.client.request."""
+
+import asyncio
+import gzip
+from collections.abc import Awaitable, Callable
+
+import aiohttp
+import pytest
+from aiohttp import web
+from aiohttp.test_utils import TestServer
+
+from fluidattacks_core.http import ResponseTooLargeError, request
+from fluidattacks_core.http.validations import HTTPValidationError, validate_url
+
+RouteHandler = Callable[[web.Request], Awaitable[web.StreamResponse]]
+_CAP = 64 * 1024
+_MAX_HOPS = 11
+
+
+async def _build_server(routes: dict[str, RouteHandler]) -> TestServer:
+    app = web.Application()
+    for path, handler in routes.items():
+        app.router.add_get(path, handler)
+        app.router.add_post(path, handler)
+    server = TestServer(app)
+    await server.start_server()
+    return server
+
+
+async def _permissive_request(
+    url: str,
+    *,
+    method: str = "GET",
+    allow_redirects: bool | None = None,
+    schemes: list[str] | None = None,
+    ports: list[int] | None = None,
+    json: object | None = None,
+) -> aiohttp.ClientResponse:
+    """Wrapper that turns off protections irrelevant to redirect-logic tests."""
+    return await request(
+        url,
+        method=method,  # type: ignore[arg-type]
+        allow_redirects=allow_redirects,
+        allow_local_network=True,
+        allow_localhost=True,
+        dns_rebind_protection=False,
+        schemes=schemes,
+        ports=ports,
+        json=json,
+    )
+
+
+def _make_server_url(server: TestServer, path: str) -> str:
+    return f"http://{server.host}:{server.port}{path}"
+
+
+@pytest.mark.asyncio
+async def test_allow_redirects_default_does_not_follow_when_rebind_protected() -> None:
+    hits: list[str] = []
+
+    async def handle_start(_req: web.Request) -> web.Response:
+        hits.append("start")
+        return web.Response(status=301, headers={"Location": "/final"})
+
+    async def handle_final(_req: web.Request) -> web.Response:
+        hits.append("final")
+        return web.Response(status=200)
+
+    server = await _build_server({"/start": handle_start, "/final": handle_final})
+    try:
+        response = await request(
+            _make_server_url(server, "/start"),
+            method="GET",
+            allow_local_network=True,
+            allow_localhost=True,
+        )
+        assert response.status == 301
+        assert hits == ["start"]
+    finally:
+        await server.close()
+
+
+@pytest.mark.asyncio
+async def test_allow_redirects_default_follows_when_rebind_disabled() -> None:
+    async def handle_start(_req: web.Request) -> web.Response:
+        return web.Response(status=301, headers={"Location": "/final"})
+
+    async def handle_final(_req: web.Request) -> web.Response:
+        return web.Response(status=200)
+
+    server = await _build_server({"/start": handle_start, "/final": handle_final})
+    try:
+        response = await _permissive_request(_make_server_url(server, "/start"))
+        assert response.status == 200
+    finally:
+        await server.close()
+
+
+@pytest.mark.asyncio
+async def test_allow_redirects_false_never_follows() -> None:
+    async def handle_start(_req: web.Request) -> web.Response:
+        return web.Response(status=301, headers={"Location": "/final"})
+
+    async def handle_final(_req: web.Request) -> web.Response:
+        return web.Response(status=200)
+
+    server = await _build_server({"/start": handle_start, "/final": handle_final})
+    try:
+        response = await _permissive_request(
+            _make_server_url(server, "/start"), allow_redirects=False
+        )
+        assert response.status == 301
+    finally:
+        await server.close()
+
+
+@pytest.mark.asyncio
+async def test_allow_redirects_true_follows_canonical_chain_to_2xx() -> None:
+    async def handle_start(_req: web.Request) -> web.Response:
+        return web.Response(status=301, headers={"Location": "/final"})
+
+    async def handle_final(_req: web.Request) -> web.Response:
+        return web.Response(status=200, text="ok")
+
+    server = await _build_server({"/start": handle_start, "/final": handle_final})
+    try:
+        response = await _permissive_request(
+            _make_server_url(server, "/start"), allow_redirects=True
+        )
+        assert response.status == 200
+        assert await response.text() == "ok"
+    finally:
+        await server.close()
+
+
+@pytest.mark.asyncio
+async def test_allow_redirects_true_validates_scheme_on_redirect_target() -> None:
+    async def handle_start(_req: web.Request) -> web.Response:
+        return web.Response(
+            status=302, headers={"Location": "ftp://outside.example.com/attack"}
+        )
+
+    server = await _build_server({"/start": handle_start})
+    try:
+        with pytest.raises(HTTPValidationError):
+            await _permissive_request(
+                _make_server_url(server, "/start"),
+                allow_redirects=True,
+                schemes=["http"],
+            )
+    finally:
+        await server.close()
+
+
+@pytest.mark.asyncio
+async def test_allow_redirects_true_validates_port_on_redirect_target() -> None:
+    async def handle_start(_req: web.Request) -> web.Response:
+        return web.Response(
+            status=302,
+            headers={"Location": "http://outside.example.com:22/attack"},
+        )
+
+    server = await _build_server({"/start": handle_start})
+    try:
+        with pytest.raises(HTTPValidationError):
+            await _permissive_request(
+                _make_server_url(server, "/start"),
+                allow_redirects=True,
+                ports=[80, 443],
+            )
+    finally:
+        await server.close()
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("status", [301, 302, 303])
+async def test_status_rewrites_follow_up_method_to_get(status: int) -> None:
+    methods: list[str] = []
+
+    async def handle_start(req: web.Request) -> web.Response:
+        methods.append(req.method)
+        return web.Response(status=status, headers={"Location": "/final"})
+
+    async def handle_final(req: web.Request) -> web.Response:
+        methods.append(req.method)
+        return web.Response(status=200)
+
+    server = await _build_server({"/start": handle_start, "/final": handle_final})
+    try:
+        response = await _permissive_request(
+            _make_server_url(server, "/start"),
+            method="POST",
+            allow_redirects=True,
+            json={"payload": "value"},
+        )
+        assert response.status == 200
+        assert methods == ["POST", "GET"]
+    finally:
+        await server.close()
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("status", [307, 308])
+async def test_status_preserves_follow_up_method(status: int) -> None:
+    methods: list[str] = []
+
+    async def handle_start(req: web.Request) -> web.Response:
+        methods.append(req.method)
+        return web.Response(status=status, headers={"Location": "/final"})
+
+    async def handle_final(req: web.Request) -> web.Response:
+        methods.append(req.method)
+        return web.Response(status=200)
+
+    server = await _build_server({"/start": handle_start, "/final": handle_final})
+    try:
+        response = await _permissive_request(
+            _make_server_url(server, "/start"),
+            method="POST",
+            allow_redirects=True,
+            json={"payload": "value"},
+        )
+        assert response.status == 200
+        assert methods == ["POST", "POST"]
+    finally:
+        await server.close()
+
+
+@pytest.mark.asyncio
+async def test_exceeding_max_redirects_raises_too_many_redirects() -> None:
+    async def handle_hop(req: web.Request) -> web.Response:
+        return web.Response(
+            status=301, headers={"Location": f"/hop?n={req.query.get('n', '0')}"}
+        )
+
+    server = await _build_server({"/hop": handle_hop})
+    try:
+        with pytest.raises(aiohttp.TooManyRedirects):
+            await _permissive_request(
+                _make_server_url(server, "/hop?n=0"), allow_redirects=True
+            )
+    finally:
+        await server.close()
+
+
+def _gzip_bomb(decompressed_bytes: int) -> bytes:
+    return gzip.compress(b"\x00" * decompressed_bytes, compresslevel=9)
+
+
+async def _build_body_server(body: bytes, headers: dict[str, str]) -> TestServer:
+    async def handler(_req: web.Request) -> web.Response:
+        return web.Response(body=body, headers=headers)
+
+    return await _build_server({"/body": handler})
+
+
+async def _capped_request(
+    url: str,
+    *,
+    max_response_bytes: int,
+    allow_redirects: bool | None = None,
+) -> aiohttp.ClientResponse:
+    return await request(
+        url,
+        method="GET",
+        allow_local_network=True,
+        allow_localhost=True,
+        allow_redirects=allow_redirects,
+        dns_rebind_protection=False,
+        max_response_bytes=max_response_bytes,
+    )
+
+
+@pytest.mark.asyncio
+async def test_compressed_body_over_cap_is_rejected() -> None:
+    bomb = _gzip_bomb(8 * 1024 * 1024)
+    server = await _build_body_server(
+        bomb,
+        {"Content-Encoding": "gzip", "Content-Type": "application/json"},
+    )
+    try:
+        assert len(bomb) < 1024 * 1024
+        with pytest.raises(ResponseTooLargeError):
+            await _capped_request(
+                _make_server_url(server, "/body"),
+                max_response_bytes=1024 * 1024,
+            )
+    finally:
+        await server.close()
+
+
+@pytest.mark.asyncio
+async def test_body_within_cap_is_still_returned() -> None:
+    server = await _build_body_server(b"payload", {})
+    try:
+        response = await _capped_request(
+            _make_server_url(server, "/body"),
+            max_response_bytes=1024 * 1024,
+        )
+        assert await response.text() == "payload"
+    finally:
+        await server.close()
+
+
+@pytest.mark.asyncio
+async def test_cap_rejects_an_oversized_body_after_a_redirect() -> None:
+    bomb = _gzip_bomb(8 * 1024 * 1024)
+
+    async def handle_start(_req: web.Request) -> web.Response:
+        return web.Response(status=302, headers={"Location": "/final"})
+
+    async def handle_final(_req: web.Request) -> web.Response:
+        return web.Response(
+            body=bomb,
+            headers={"Content-Encoding": "gzip", "Content-Type": "application/json"},
+        )
+
+    server = await _build_server({"/start": handle_start, "/final": handle_final})
+    try:
+        with pytest.raises(ResponseTooLargeError):
+            await _capped_request(
+                _make_server_url(server, "/start"),
+                max_response_bytes=1024 * 1024,
+                allow_redirects=True,
+            )
+    finally:
+        await server.close()
+
+
+@pytest.mark.asyncio
+async def test_declared_length_over_cap_is_rejected() -> None:
+    server = await _build_body_server(b"a" * (2 * 1024 * 1024), {})
+    try:
+        with pytest.raises(ResponseTooLargeError, match="declares"):
+            await _capped_request(
+                _make_server_url(server, "/body"),
+                max_response_bytes=1024 * 1024,
+            )
+    finally:
+        await server.close()
+
+
+@pytest.mark.parametrize(
+    "url",
+    [
+        "//evil.example/jwks",
+        "//evil.example:8080/jwks",
+        "evil.example/jwks",
+        "evil.example:8080/jwks",
+    ],
+)
+def test_schemeless_url_is_rejected_when_schemes_are_restricted(url: str) -> None:
+    with pytest.raises(HTTPValidationError):
+        validate_url(
+            url,
+            ascii_only=False,
+            enforce_sanitization=False,
+            ports=[],
+            schemes=["https"],
+        )
+
+
+def test_allowed_scheme_still_passes() -> None:
+    validate_url(
+        "https://good.example/jwks",
+        ascii_only=False,
+        enforce_sanitization=False,
+        ports=[],
+        schemes=["https"],
+    )
+
+
+@pytest.mark.asyncio
+async def test_relative_redirect_keeps_the_scheme_of_its_base() -> None:
+    async def handle_start(_req: web.Request) -> web.Response:
+        return web.Response(status=302, headers={"Location": "/final"})
+
+    async def handle_final(_req: web.Request) -> web.Response:
+        return web.Response(status=200, text="ok")
+
+    server = await _build_server({"/start": handle_start, "/final": handle_final})
+    try:
+        response = await _permissive_request(
+            _make_server_url(server, "/start"),
+            allow_redirects=True,
+            schemes=["http"],
+        )
+        assert response.status == 200
+        assert await response.text() == "ok"
+    finally:
+        await server.close()
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("compressed", [False, True])
+async def test_cap_admits_a_body_of_exactly_the_limit(compressed: bool) -> None:
+    body = _gzip_bomb(_CAP) if compressed else b"a" * _CAP
+    headers = {"Content-Encoding": "gzip"} if compressed else {}
+    server = await _build_body_server(body, headers)
+    try:
+        response = await _capped_request(
+            _make_server_url(server, "/body"), max_response_bytes=_CAP
+        )
+        assert len(await response.text()) == _CAP
+    finally:
+        await server.close()
+
+
+@pytest.mark.asyncio
+async def test_cap_bounds_each_hop_rather_than_the_whole_chain() -> None:
+    # The accepted multiplier: every hop may serve just under the cap, so a
+    # full chain moves _MAX_HOPS times the limit and still succeeds.
+    body = b"a" * (_CAP - 1)
+
+    async def handle_hop(req: web.Request) -> web.Response:
+        hop = int(req.query.get("n", "0"))
+        if hop >= _MAX_HOPS - 1:
+            return web.Response(body=body)
+        return web.Response(
+            status=302, body=body, headers={"Location": f"/hop?n={hop + 1}"}
+        )
+
+    server = await _build_server({"/hop": handle_hop})
+    try:
+        response = await _capped_request(
+            _make_server_url(server, "/hop?n=0"),
+            max_response_bytes=_CAP,
+            allow_redirects=True,
+        )
+        assert response.status == 200
+        assert len(await response.text()) == _CAP - 1
+    finally:
+        await server.close()
+
+def test_response_too_large_stays_catchable_as_a_client_error() -> None:
+    # Callers degrade gracefully on transport failures; narrowing this base
+    # converts their soft fallbacks into client-facing errors, and in one
+    # fire-and-forget path drops the log entirely.
+    assert issubclass(ResponseTooLargeError, aiohttp.ClientError)
+
+
+@pytest.mark.asyncio
+async def test_concurrent_requests_do_not_share_a_cap() -> None:
+    # The cap reaches the response through context, so overlapping requests
+    # must not observe each other's limit.
+    server = await _build_body_server(
+        _gzip_bomb(4 * 1024 * 1024), {"Content-Encoding": "gzip"}
+    )
+    url = _make_server_url(server, "/body")
+    try:
+        tight, generous = await asyncio.gather(
+            _capped_request(url, max_response_bytes=1024 * 1024),
+            _capped_request(url, max_response_bytes=32 * 1024 * 1024),
+            return_exceptions=True,
+        )
+        assert isinstance(tight, ResponseTooLargeError)
+        assert not isinstance(generous, BaseException)
+        assert len(await generous.text()) == 4 * 1024 * 1024
+    finally:
+        await server.close()

{fluidattacks_core_http-12.0.0 → fluidattacks_core_http-12.2.0}/uv.lock

@@ -217,7 +217,7 @@ wheels = [
 
 [[package]]
 name = "fluidattacks-core-http"
-version = "12.0.0"
+version = "12.2.0"
 source = { editable = "." }
 dependencies = [
     { name = "aiohttp" },
@@ -230,6 +230,8 @@ dev = [
     { name = "deptry" },
     { name = "import-linter" },
     { name = "mypy" },
+    { name = "pytest" },
+    { name = "pytest-asyncio" },
     { name = "ruff" },
 ]
 
@@ -245,6 +247,8 @@ dev = [
     { name = "deptry", specifier = ">=0.23.1" },
     { name = "import-linter", specifier = "==2.11" },
     { name = "mypy", specifier = "==1.19.1" },
+    { name = "pytest", specifier = "==9.0.3" },
+    { name = "pytest-asyncio", specifier = ">=1.1.0" },
     { name = "ruff", specifier = "==0.15.0" },
 ]
 
@@ -465,6 +469,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/e9/aa/2ed2c89543632ded7196e0d93dcc6c7fe87769e88391a648c4a298ea864a/import_linter-2.11-py3-none-any.whl", hash = "sha256:3dc54cae933bae3430358c30989762b721c77aa99d424f56a08265be0eeaa465", size = 637315, upload-time = "2026-03-06T12:11:36.599Z" },
 ]
 
+[[package]]
+name = "iniconfig"
+version = "2.3.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/72/34/14ca021ce8e5dfedc35312d08ba8bf51fdd999c576889fc2c24cb97f4f10/iniconfig-2.3.0.tar.gz", hash = "sha256:c76315c77db068650d49c5b56314774a7804df16fee4402c1f19d6d15d8c4730", size = 20503, upload-time = "2025-10-18T21:55:43.219Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/cb/b1/3846dd7f199d53cb17f49cba7e651e9ce294d8497c8c150530ed11865bb8/iniconfig-2.3.0-py3-none-any.whl", hash = "sha256:f631c04d2c48c52b84d0d0549c99ff3859c98df65b3101406327ecc7d53fbf12", size = 7484, upload-time = "2025-10-18T21:55:41.639Z" },
+]
+
 [[package]]
 name = "librt"
 version = "0.13.0"
@@ -744,6 +757,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/f1/d9/7fb5aa316bc299258e68c73ba3bddbc499654a07f151cba08f6153988714/pathspec-1.1.1-py3-none-any.whl", hash = "sha256:a00ce642f577bf7f473932318056212bc4f8bfdf53128c78bbd5af0b9b20b189", size = 57328, upload-time = "2026-04-27T01:46:07.06Z" },
 ]
 
+[[package]]
+name = "pluggy"
+version = "1.6.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f9/e2/3e91f31a7d2b083fe6ef3fa267035b518369d9511ffab804f839851d2779/pluggy-1.6.0.tar.gz", hash = "sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3", size = 69412, upload-time = "2025-05-15T12:30:07.975Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/54/20/4d324d65cc6d9205fabedc306948156824eb9f0ee1633355a8f7ec5c66bf/pluggy-1.6.0-py3-none-any.whl", hash = "sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746", size = 20538, upload-time = "2025-05-15T12:30:06.134Z" },
+]
+
 [[package]]
 name = "propcache"
 version = "0.5.2"
@@ -864,6 +886,35 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/f4/7e/a72dd26f3b0f4f2bf1dd8923c85f7ceb43172af56d63c7383eb62b332364/pygments-2.20.0-py3-none-any.whl", hash = "sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176", size = 1231151, upload-time = "2026-03-29T13:29:30.038Z" },
 ]
 
+[[package]]
+name = "pytest"
+version = "9.0.3"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+    { name = "iniconfig" },
+    { name = "packaging" },
+    { name = "pluggy" },
+    { name = "pygments" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/7d/0d/549bd94f1a0a402dc8cf64563a117c0f3765662e2e668477624baeec44d5/pytest-9.0.3.tar.gz", hash = "sha256:b86ada508af81d19edeb213c681b1d48246c1a91d304c6c81a427674c17eb91c", size = 1572165, upload-time = "2026-04-07T17:16:18.027Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d4/24/a372aaf5c9b7208e7112038812994107bc65a84cd00e0354a88c2c77a617/pytest-9.0.3-py3-none-any.whl", hash = "sha256:2c5efc453d45394fdd706ade797c0a81091eccd1d6e4bccfcd476e2b8e0ab5d9", size = 375249, upload-time = "2026-04-07T17:16:16.13Z" },
+]
+
+[[package]]
+name = "pytest-asyncio"
+version = "1.4.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pytest" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/43/7c/d36d04db312ecf4298932ef77e6e4a9e8ad017906e24e34f0b0c361a2473/pytest_asyncio-1.4.0.tar.gz", hash = "sha256:c6c0d2259945122819f171a32ecea2c349ead889ee28176caaf492143424be42", size = 58514, upload-time = "2026-05-26T09:56:04.083Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/03/e2/08a497ef684b88559c9cc5f4ad53a37e7b99e727094a86d6ea32536d5d3c/pytest_asyncio-1.4.0-py3-none-any.whl", hash = "sha256:933ca923a23075a87fb7070c0ec272a6848489824d887c85c812670932835aa1", size = 16930, upload-time = "2026-05-26T09:56:02.576Z" },
+]
+
 [[package]]
 name = "requirements-parser"
 version = "0.13.1"

fluidattacks_core_http-12.0.0/build/default.nix

@@ -1,20 +0,0 @@
-{ src, workspace_root }:
-{
-  inherit src workspace_root;
-  root_path = "develops/fluidattacks-core/python/http";
-  module_name = "fluidattacks_core";
-  pypi_token = {
-    method = "oidc";
-  };
-  override = {
-    checks = {
-      basedpyright = false;
-      pytest = false;
-    };
-    configs = {
-      import_linter = ../import-linter.cfg;
-      mypy = ../mypy.ini;
-      ruff = ../ruff.toml;
-    };
-  };
-}

fluidattacks_core_http-12.0.0/build/filter.nix

@@ -1,12 +0,0 @@
-path_filter: src:
-path_filter {
-  root = src;
-  include = [
-    "fluidattacks_core"
-    "import-linter.cfg"
-    "mypy.ini"
-    "pyproject.toml"
-    "ruff.toml"
-    "uv.lock"
-  ];
-}

fluidattacks_core_http-12.0.0/flake.lock

@@ -1,303 +0,0 @@
-{
-  "nodes": {
-    "flake-parts": {
-      "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib"
-      },
-      "locked": {
-        "lastModified": 1762810396,
-        "narHash": "sha256-dxFVgQPG+R72dkhXTtqUm7KpxElw3u6E+YlQ2WaDgt8=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "0bdadb1b265fb4143a75bd1ec7d8c915898a9923",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "nix_filter": {
-      "locked": {
-        "lastModified": 1757882181,
-        "narHash": "sha256-+cCxYIh2UNalTz364p+QYmWHs0P+6wDhiWR4jDIKQIU=",
-        "owner": "numtide",
-        "repo": "nix-filter",
-        "rev": "59c44d1909c72441144b93cf0f054be7fe764de5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "nix-filter",
-        "type": "github"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1758690382,
-        "narHash": "sha256-NY3kSorgqE5LMm1LqNwGne3ZLMF2/ILgLpFr1fS4X3o=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "e643668fd71b949c53f8626614b21ff71a07379d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-lib": {
-      "locked": {
-        "lastModified": 1761765539,
-        "narHash": "sha256-b0yj6kfvO8ApcSE+QmA6mUfu8IYG6/uU28OFn4PaC8M=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "719359f4562934ae99f5443f20aa06c2ffff91fc",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1758690382,
-        "narHash": "sha256-NY3kSorgqE5LMm1LqNwGne3ZLMF2/ILgLpFr1fS4X3o=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "e643668fd71b949c53f8626614b21ff71a07379d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1761373498,
-        "narHash": "sha256-Q/uhWNvd7V7k1H1ZPMy/vkx3F8C13ZcdrKjO7Jv7v0c=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "6a08e6bb4e46ff7fcbb53d409b253f6bad8a28ce",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_flake": {
-      "locked": {
-        "lastModified": 1778253243,
-        "narHash": "sha256-KkH2QvU6iRLDTGGEwH5jnMqHWj4zMTuHxi1S1zdr01w=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "4fcda7103530b23c5ca44286344912082aad4220",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "pyproject-build-systems": {
-      "inputs": {
-        "nixpkgs": "nixpkgs",
-        "pyproject-nix": "pyproject-nix",
-        "uv2nix": "uv2nix"
-      },
-      "locked": {
-        "lastModified": 1761781027,
-        "narHash": "sha256-YDvxPAm2WnxrznRqWwHLjryBGG5Ey1ATEJXrON+TWt8=",
-        "owner": "pyproject-nix",
-        "repo": "build-system-pkgs",
-        "rev": "795a980d25301e5133eca37adae37283ec3c8e66",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "build-system-pkgs",
-        "type": "github"
-      }
-    },
-    "pyproject-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "python_builder",
-          "pyproject-build-systems",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1758265079,
-        "narHash": "sha256-amLaLNwKSZPShQHzfgmc/9o76dU8xzN0743dWgvYlr8=",
-        "owner": "nix-community",
-        "repo": "pyproject.nix",
-        "rev": "02e9418fd4af638447dca4b17b1280da95527fc9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "pyproject.nix",
-        "type": "github"
-      }
-    },
-    "pyproject-nix_2": {
-      "inputs": {
-        "nixpkgs": "nixpkgs_2"
-      },
-      "locked": {
-        "lastModified": 1762427963,
-        "narHash": "sha256-CkPlAbIQ87wmjy5qHibfzk4DmMGBNqFer+lLfXjpP5M=",
-        "owner": "pyproject-nix",
-        "repo": "pyproject.nix",
-        "rev": "4540ea004e04fcd12dd2738d51383d10f956f7b9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "pyproject.nix",
-        "type": "github"
-      }
-    },
-    "pyproject-nix_3": {
-      "inputs": {
-        "nixpkgs": [
-          "python_builder",
-          "uv2nix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1760402624,
-        "narHash": "sha256-jF6UKLs2uGc2rtved8Vrt58oTWjTQoAssuYs/0578Z4=",
-        "owner": "pyproject-nix",
-        "repo": "pyproject.nix",
-        "rev": "84c4ea102127c77058ea1ed7be7300261fafc7d2",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "pyproject.nix",
-        "type": "github"
-      }
-    },
-    "python_builder": {
-      "inputs": {
-        "nix_filter": "nix_filter",
-        "nixpkgs_flake": "nixpkgs_flake",
-        "pyproject-build-systems": "pyproject-build-systems",
-        "pyproject-nix": "pyproject-nix_2",
-        "shell-helpers": "shell-helpers",
-        "uv2nix": "uv2nix_2"
-      },
-      "locked": {
-        "dir": "common/utils/python-builder",
-        "lastModified": 1787078362,
-        "narHash": "sha256-HYL7Rn6SuNjYxkt/PwFLksZjsauCiY+ENbOWryLsIlw=",
-        "ref": "refs/heads/trunk",
-        "rev": "09fd25a13309eb5e3b5b2a061bb340df3ae5d281",
-        "shallow": true,
-        "type": "git",
-        "url": "ssh://git@gitlab.com/fluidattacks/universe"
-      },
-      "original": {
-        "dir": "common/utils/python-builder",
-        "rev": "09fd25a13309eb5e3b5b2a061bb340df3ae5d281",
-        "shallow": true,
-        "type": "git",
-        "url": "ssh://git@gitlab.com/fluidattacks/universe"
-      }
-    },
-    "root": {
-      "inputs": {
-        "python_builder": "python_builder"
-      }
-    },
-    "shell-helpers": {
-      "inputs": {
-        "flake-parts": "flake-parts",
-        "nixpkgs": [
-          "python_builder",
-          "nixpkgs_flake"
-        ]
-      },
-      "locked": {
-        "dir": "common/utils/shell-helpers",
-        "lastModified": 1762806066,
-        "narHash": "sha256-Wz99Fl7SpPU1NkTHJ36XOo6DjOEAMXCw3ThRABOS2Hs=",
-        "ref": "refs/heads/trunk",
-        "rev": "d73cfdc7ae9e7f547e22a4481d4c2ccce38b26a8",
-        "shallow": true,
-        "type": "git",
-        "url": "ssh://git@gitlab.com/fluidattacks/universe"
-      },
-      "original": {
-        "dir": "common/utils/shell-helpers",
-        "rev": "d73cfdc7ae9e7f547e22a4481d4c2ccce38b26a8",
-        "shallow": true,
-        "type": "git",
-        "url": "ssh://git@gitlab.com/fluidattacks/universe"
-      }
-    },
-    "uv2nix": {
-      "inputs": {
-        "nixpkgs": [
-          "python_builder",
-          "pyproject-build-systems",
-          "nixpkgs"
-        ],
-        "pyproject-nix": [
-          "python_builder",
-          "pyproject-build-systems",
-          "pyproject-nix"
-        ]
-      },
-      "locked": {
-        "lastModified": 1758933732,
-        "narHash": "sha256-HAmm1GBS1myZCFuog0DC2ZLaynvZtiUI2Crmo+cdQI0=",
-        "owner": "pyproject-nix",
-        "repo": "uv2nix",
-        "rev": "273ce18f913d8559e0d04f820d724308966d7c4d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "uv2nix",
-        "type": "github"
-      }
-    },
-    "uv2nix_2": {
-      "inputs": {
-        "nixpkgs": "nixpkgs_3",
-        "pyproject-nix": "pyproject-nix_3"
-      },
-      "locked": {
-        "lastModified": 1761872265,
-        "narHash": "sha256-i25GRgp2vUOebY70L3NTAgkd+Pr1hnn5xM3qHxH0ONU=",
-        "owner": "pyproject-nix",
-        "repo": "uv2nix",
-        "rev": "74dfb62871be152ad3673b143b0cc56105a4f3c5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "uv2nix",
-        "type": "github"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}

fluidattacks_core_http-12.0.0/flake.nix

@@ -1,29 +0,0 @@
-{
-  description = "Fluid Attacks Core http package.";
-
-  inputs = {
-    python_builder = {
-      url = "git+ssh://git@gitlab.com/fluidattacks/universe?shallow=1&rev=09fd25a13309eb5e3b5b2a061bb340df3ae5d281&dir=common/utils/python-builder";
-    };
-  };
-
-  outputs =
-    { self, ... }@inputs:
-    let
-      build_args =
-        {
-          system,
-          python_version,
-          nixpkgs,
-          builders,
-          scripts,
-        }:
-        import ./build {
-          src = import ./build/filter.nix nixpkgs.nix-filter self;
-          workspace_root = ./.;
-        };
-    in
-    {
-      packages = inputs.python_builder.outputs.build build_args;
-    };
-}

fluidattacks_core_http-12.0.0/fluidattacks_core/http/__init__.py

@@ -1,5 +0,0 @@
-from .client import (
-    request,
-)
-
-__all__ = ["request"]

fluidattacks_core_http-12.0.0/fluidattacks_core/http/client.py

@@ -1,90 +0,0 @@
-import ipaddress
-import ssl
-from collections.abc import Sequence
-from typing import (
-    Any,
-    Literal,
-)
-
-import aiohttp
-import certifi
-
-from .validations import (
-    validate_local_request,
-    validate_url,
-)
-
-
-def get_secure_connector(
-    *,
-    allow_local_network: bool,
-    allow_localhost: bool,
-) -> type[aiohttp.TCPConnector]:
-    class SecureTCPConnector(aiohttp.TCPConnector):
-        async def _resolve_host(
-            self,
-            host: str,
-            port: int,
-            traces: Sequence[aiohttp.tracing.Trace] | None = None,
-        ) -> list[aiohttp.abc.ResolveResult]:
-            hosts = await super()._resolve_host(host, port, traces)
-            resolved_ips = [ipaddress.ip_address(host["host"]) for host in hosts]
-            validate_local_request(
-                resolved_ips,
-                allow_local_network=allow_local_network,
-                allow_localhost=allow_localhost,
-            )
-            return hosts
-
-    return SecureTCPConnector
-
-
-async def request(  # noqa: PLR0913
-    url: str,
-    *,
-    method: Literal["GET", "POST", "PUT", "PATCH", "DELETE"],
-    allow_local_network: bool = False,
-    allow_localhost: bool = False,
-    ascii_only: bool = False,
-    dns_rebind_protection: bool = True,
-    enforce_sanitization: bool = False,
-    headers: dict[str, str] | None = None,
-    json: Any | None = None,  # noqa: ANN401
-    ports: list[int] | None = None,
-    schemes: list[str] | None = None,
-    timeout: int = 10,  # noqa: ASYNC109
-) -> aiohttp.ClientResponse:
-    validate_url(
-        url,
-        ascii_only=ascii_only,
-        enforce_sanitization=enforce_sanitization,
-        ports=ports or [],
-        schemes=schemes or [],
-    )
-    connector = (
-        get_secure_connector(
-            allow_local_network=allow_local_network,
-            allow_localhost=allow_localhost,
-        )
-        if dns_rebind_protection
-        else aiohttp.TCPConnector
-    )
-    connection = connector(
-        ssl=ssl.create_default_context(cafile=certifi.where()),
-    )
-
-    async with (
-        aiohttp.ClientSession(
-            connector=connection,
-            headers=headers,
-        ) as session,
-        session.request(
-            method,
-            url,
-            allow_redirects=not dns_rebind_protection,
-            json=json,
-            timeout=aiohttp.ClientTimeout(total=timeout),
-        ) as response,
-    ):
-        await response.read()
-        return response