microsoft-agents-hosting-core 1.9.0.dev0__tar.gz → 1.9.0.dev3__tar.gz

{microsoft_agents_hosting_core-1.9.0.dev0 → microsoft_agents_hosting_core-1.9.0.dev3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: microsoft-agents-hosting-core
-Version: 1.9.0.dev0
+Version: 1.9.0.dev3
 Summary: Core library for Microsoft Agents
 Author: Microsoft Corporation
 License-Expression: MIT
@@ -15,13 +15,13 @@ Classifier: Operating System :: OS Independent
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: microsoft-agents-activity==1.9.0.dev0
+Requires-Dist: microsoft-agents-activity==1.9.0.dev3
 Requires-Dist: pyjwt>=2.10.1
 Requires-Dist: isodate>=0.6.1
 Requires-Dist: python-dotenv>=1.1.1
 Requires-Dist: opentelemetry-api>=1.27.0
 Requires-Dist: opentelemetry-sdk>=1.27.0
-Requires-Dist: aiohttp>=3.11.11
+Requires-Dist: aiohttp>=3.12
 Requires-Dist: yarl<2.0,>=1.17.0
 Requires-Dist: azure-core
 Dynamic: license-file

microsoft_agents_hosting_core-1.9.0.dev3/VERSION.txt

@@ -0,0 +1 @@
+1.9.0.dev3

{microsoft_agents_hosting_core-1.9.0.dev0 → microsoft_agents_hosting_core-1.9.0.dev3}/microsoft_agents/hosting/core/__init__.py

@@ -9,7 +9,9 @@ from .message_factory import MessageFactory
 from .middleware_set import Middleware, MiddlewareSet
 from .rest_channel_service_client_factory import RestChannelServiceClientFactory
 from .turn_context import TurnContext
-from .outbound_host_validator import OutboundHostValidator
+
+# Security
+from .security import OutboundHostValidator
 
 # HTTP abstractions
 from .http import (

{microsoft_agents_hosting_core-1.9.0.dev0 → microsoft_agents_hosting_core-1.9.0.dev3}/microsoft_agents/hosting/core/_http_adapter_base.py

@@ -23,7 +23,7 @@ from .http._http_response import HttpResponse, HttpResponseFactory
 from .message_factory import MessageFactory
 from .rest_channel_service_client_factory import RestChannelServiceClientFactory
 from .turn_context import TurnContext
-from .outbound_host_validator import OutboundHostValidator, _try_create_url
+from .security import OutboundHostValidator, _try_create_url
 
 logger = logging.getLogger(__name__)
 
@@ -80,7 +80,7 @@ class HttpAdapterBase(ChannelServiceAdapter, ABC):
                 connection_manager,
                 **(channel_service_client_factory_options or {}),
             )
-        self._host_validator = host_validator or OutboundHostValidator()
+        self._host_validator = host_validator or OutboundHostValidator(enabled=False)
 
         super().__init__(factory)
 
@@ -205,7 +205,7 @@ class HttpAdapterBase(ChannelServiceAdapter, ABC):
                 or not activity_url
                 or claim_url_host.casefold() != activity_url_host.casefold()
             ):
-                if self._host_validator and self._host_validator.enabled:
+                if self._host_validator.enabled:
                     logger.warning(
                         "Service URL host mismatch: %s vs %s",
                         claim_url_host,

{microsoft_agents_hosting_core-1.9.0.dev0 → microsoft_agents_hosting_core-1.9.0.dev3}/microsoft_agents/hosting/core/app/attachment_downloader.py

@@ -2,7 +2,8 @@
 # Licensed under the MIT License.
 
 import json
-from typing import Callable
+import logging
+from typing import Any, Callable
 
 import aiohttp
 
@@ -13,27 +14,40 @@ from microsoft_agents.activity import (
 )
 
 from microsoft_agents.hosting.core.turn_context import TurnContext
-from microsoft_agents.hosting.core.outbound_host_validator import OutboundHostValidator
+from microsoft_agents.hosting.core.security import (
+    OutboundHostValidator,
+    _SSRFError,
+)
 
 from .input_file import InputFileDownloader, InputFile
 from ._utils import _parse_content_type, _basic_url_check
 
+logger = logging.getLogger(__name__)
+
 
 class AttachmentDownloader(InputFileDownloader):
     """Downloads attachments from a given turn context."""
 
     def __init__(
         self,
-        client_factory: Callable[[], aiohttp.ClientSession] | None = None,
         host_validator: OutboundHostValidator | None = None,
+        *,
+        client_session_kwargs: dict | None = None,
+        client_factory: Any = None,
     ):
         """Constructor for AttachmentDownloader.
 
-        :param client_factory: A callable that returns an aiohttp.ClientSession instance.
         :param host_validator: An optional OutboundHostValidator instance.
+        :param client_session_kwargs: Optional keyword arguments for the aiohttp.ClientSession.
+        :param client_factory: (deprecated) A custom client factory, if any.
         """
 
-        self._client_factory = client_factory or aiohttp.ClientSession
+        if client_factory is not None:
+            logger.warning(
+                "The 'client_factory' parameter is deprecated and will be ignored."
+            )
+
+        self._client_session_kwargs = client_session_kwargs or {}
         self._host_validator = host_validator
 
     async def download_files(self, context: TurnContext) -> list[InputFile]:
@@ -48,31 +62,36 @@ class AttachmentDownloader(InputFileDownloader):
         if not context.activity.attachments:
             return []
 
-        files: list[InputFile] = []
-        for attachment in context.activity.attachments:
-            file = await self._download_file(attachment)
-            if file:
-                files.append(file)
+        client_factory: Callable[[], aiohttp.ClientSession]
+        if self._host_validator is not None:
+            host_validator = self._host_validator  # to capture in lambda
+            client_factory = lambda: host_validator.client(self._client_session_kwargs)
+        else:
+            client_factory = lambda: aiohttp.ClientSession(
+                **self._client_session_kwargs
+            )
 
+        async with client_factory() as client:
+            files: list[InputFile] = []
+            for attachment in context.activity.attachments:
+                file = await self._download_file(client, attachment)
+                if file:
+                    files.append(file)
         return files
 
-    async def _download_file(self, attachment: Attachment) -> InputFile | None:
+    async def _download_file(
+        self, client: aiohttp.ClientSession, attachment: Attachment
+    ) -> InputFile | None:
         """Downloads a single file from the given attachment.
 
+        :param client: The aiohttp.ClientSession instance to use for downloading the file.
         :param attachment: The attachment to download.
         :return: An InputFile instance if the download is successful, None otherwise.
         """
         if attachment.content_url and _basic_url_check(attachment.content_url):
             remote_file_url = attachment.content_url
 
-            if (
-                self._host_validator
-                and self._host_validator.enabled
-                and not self._host_validator.is_allowed(remote_file_url)
-            ):
-                return None
-
-            async with self._client_factory() as client:
+            try:
                 async with client.get(remote_file_url) as response:
 
                     if not (200 <= response.status < 300):
@@ -94,6 +113,11 @@ class AttachmentDownloader(InputFileDownloader):
                         content_url=attachment.content_url,
                         filename=attachment.name,
                     )
+            except _SSRFError:
+                logger.warning(
+                    "Outbound host validation failed for an attachment download URL."
+                )
+                return None
         else:
             content = bytes(json.dumps(attachment.content), "utf-8")
             return InputFile(

{microsoft_agents_hosting_core-1.9.0.dev0 → microsoft_agents_hosting_core-1.9.0.dev3}/microsoft_agents/hosting/core/app/m365_attachment_downloader.py

@@ -2,6 +2,9 @@
 # Licensed under the MIT License.
 
 import json
+import logging
+import warnings
+
 from typing import Callable, cast, Any
 
 import aiohttp
@@ -9,7 +12,6 @@ import aiohttp
 from microsoft_agents.activity import (
     Attachment,
     Channels,
-    ChannelId,
 )
 
 from microsoft_agents.hosting.core.authorization import (
@@ -17,11 +19,16 @@ from microsoft_agents.hosting.core.authorization import (
     Connections,
 )
 from microsoft_agents.hosting.core.turn_context import TurnContext
-from microsoft_agents.hosting.core.outbound_host_validator import OutboundHostValidator
+from microsoft_agents.hosting.core.security import (
+    OutboundHostValidator,
+    _SSRFError,
+)
 
 from .input_file import InputFileDownloader, InputFile
 from ._utils import _parse_content_type, _basic_url_check
 
+logger = logging.getLogger(__name__)
+
 
 class M365AttachmentDownloader(InputFileDownloader):
     """Downloads attachments from M365/Teams using the configured Token Provider (from Connections)."""
@@ -29,27 +36,35 @@ class M365AttachmentDownloader(InputFileDownloader):
     def __init__(
         self,
         connections: Connections,
-        client_factory: Callable[[], aiohttp.ClientSession] | None = None,
         host_validator: OutboundHostValidator | None = None,
         *,
+        client_session_kwargs: dict[str, Any] | None = None,
         token_provider_name: str = "",
         use_anonymous: bool = False,
         scopes: list[str] | None = None,
+        client_factory: Any = None,
     ):
         """Constructor for M365AttachmentDownloader.
 
         :param connections: A Connections instance.
-        :param client_factory: A callable that returns an aiohttp.ClientSession instance.
         :param host_validator: An optional OutboundHostValidator instance.
+        :param client_session_kwargs: Optional keyword arguments to pass to the aiohttp ClientSession constructor.
         :param token_provider_name: The name of the token provider.
         :param use_anonymous: Whether to use anonymous access.
         :param scopes: A list of scopes for the access token.
-        :param connections: A Connections instance.
+        :param client_factory: (deprecated) A custom client factory, if any.
         """
 
+        if client_factory is not None:
+            warnings.warn(
+                "The 'client_factory' parameter is deprecated and will be ignored.",
+                DeprecationWarning,
+                stacklevel=2,
+            )
+
         self._connections = connections
-        self._client_factory = client_factory or aiohttp.ClientSession
         self._host_validator = host_validator
+        self._client_session_kwargs = client_session_kwargs or {}
 
         self._token_provider_name = token_provider_name
         self._use_anonymous = use_anonymous
@@ -109,19 +124,32 @@ class M365AttachmentDownloader(InputFileDownloader):
                 outgoing_audience_claim, self._scopes
             )
 
-        files: list[InputFile] = []
-        for att in attachments:
-            file = await self._download_file(att, access_token)
-            if file:
-                files.append(file)
+        client_factory: Callable[[], aiohttp.ClientSession]
+        if self._host_validator is not None:
+            host_validator = self._host_validator  # to
+            client_factory = lambda: host_validator.client(self._client_session_kwargs)
+        else:
+            client_factory = lambda: aiohttp.ClientSession(
+                **self._client_session_kwargs
+            )
 
+        async with client_factory() as client:
+            files: list[InputFile] = []
+            for att in attachments:
+                file = await self._download_file(client, att, access_token)
+                if file:
+                    files.append(file)
         return files
 
     async def _download_file(
-        self, attachment: Attachment, access_token: str
+        self,
+        client: aiohttp.ClientSession,
+        attachment: Attachment,
+        access_token: str,
     ) -> InputFile | None:
         """Download a single file from the given attachment.
 
+        :param client: The aiohttp.ClientSession instance to use for downloading the file.
         :param attachment: The Attachment instance.
         :param access_token: The access token for authentication.
         :return: An InputFile instance or None if the download fails.
@@ -136,16 +164,10 @@ class M365AttachmentDownloader(InputFileDownloader):
             download_url = attachment.content_url
 
         if download_url and _basic_url_check(download_url):
-            if (
-                self._host_validator is not None
-                and self._host_validator.enabled
-                and not self._host_validator.is_allowed(download_url)
-            ):
-                return None
-
-            async with self._client_factory() as client:
+            try:
                 async with client.get(
-                    download_url, headers={"Authorization": f"Bearer {access_token}"}
+                    download_url,
+                    headers={"Authorization": f"Bearer {access_token}"},
                 ) as response:
                     if not (200 <= response.status < 300):
                         return None
@@ -165,6 +187,11 @@ class M365AttachmentDownloader(InputFileDownloader):
                         content_url=attachment.content_url,
                         filename=name,
                     )
+            except _SSRFError:
+                logger.warning(
+                    "Outbound host validation failed for an attachment download URL."
+                )
+                return None
         else:
             content = bytes(json.dumps(attachment.content), "utf-8")
             return InputFile(

{microsoft_agents_hosting_core-1.9.0.dev0 → microsoft_agents_hosting_core-1.9.0.dev3}/microsoft_agents/hosting/core/app/streaming/streaming_response.py

@@ -6,6 +6,7 @@ from __future__ import annotations
 import uuid
 import asyncio
 import logging
+from collections.abc import Mapping
 from typing import Optional, Callable, Literal, cast, TYPE_CHECKING
 
 from microsoft_agents.activity import (
@@ -499,6 +500,12 @@ class StreamingResponse:
         )
         if self._should_update_final_activity() and self._stream_id:
             activity.id = self._stream_id
+
+        if self._enable_feedback_loop and self._is_teams_channel():
+            self._add_feedback_loop_to_channel_data(activity)
+
+        self._add_generated_by_ai_metadata(activity)
+
         return activity
 
     def _create_stream_stopped_message(self, message: str) -> Activity:
@@ -514,6 +521,7 @@ class StreamingResponse:
                 )
             ],
         )
+        self._add_generated_by_ai_metadata(activity)
         return activity
 
     def _create_stream_timed_out_message(
@@ -534,12 +542,15 @@ class StreamingResponse:
                 stream_info.stream_id = self._stream_id
             entities.append(stream_info)
 
-        return Activity(
+        activity = Activity(
             id=self._stream_id,
             type="message",
             text=text,
             entities=entities,
         )
+        if add_stream_final:
+            self._add_generated_by_ai_metadata(activity)
+        return activity
 
     def _create_stream_timed_out_streaming_update(self) -> Activity:
         text = (
@@ -615,23 +626,6 @@ class StreamingResponse:
                     )
                 )
 
-        # Add in Powered by AI feature flags
-        if self._ended:
-            if self._enable_feedback_loop and self._feedback_loop_type:
-                # Add feedback loop to streaminfo entity
-                if streaminfo_entity:
-                    streaminfo_entity.feedback_loop = {"type": self._feedback_loop_type}
-            else:
-                # Add feedback loop enabled to streaminfo entity
-                if streaminfo_entity:
-                    streaminfo_entity.feedback_loop_enabled = self._enable_feedback_loop
-        # Add in Generated by AI
-        if self._enable_generated_by_ai_label:
-            curr_citations = CitationUtil.get_used_citations(
-                self._message, self._citations
-            )
-            activity.add_ai_metadata(curr_citations, self._sensitivity_label)
-
         try:
             response = await self._context.send_activity(activity)
 
@@ -840,6 +834,38 @@ class StreamingResponse:
         channel_id = self._context.activity.channel_id
         return bool(channel_id) and channel_id.channel == Channels.ms_teams
 
+    def _add_feedback_loop_to_channel_data(self, activity: Activity) -> None:
+        channel_data = activity.channel_data
+        if channel_data is None:
+            serialized_channel_data = {}
+        elif isinstance(channel_data, Mapping):
+            serialized_channel_data = dict(channel_data)
+        elif callable(model_dump := getattr(channel_data, "model_dump", None)):
+            serialized_channel_data = model_dump(
+                mode="json",
+                by_alias=True,
+                exclude_none=True,
+                exclude_unset=True,
+            )
+        else:
+            logger.warning(
+                "Unable to add feedback loop to unsupported channel data type: %s",
+                type(channel_data).__name__,
+            )
+            return
+
+        serialized_channel_data["feedbackLoop"] = {
+            "type": self._feedback_loop_type or "default"
+        }
+        activity.channel_data = serialized_channel_data
+
+    def _add_generated_by_ai_metadata(self, activity: Activity) -> None:
+        if not self._enable_generated_by_ai_label:
+            return
+
+        curr_citations = CitationUtil.get_used_citations(self._message, self._citations)
+        activity.add_ai_metadata(curr_citations, self._sensitivity_label)
+
     def _should_update_final_activity(self) -> bool:
         if self._is_m365_copilot():
             return False

{microsoft_agents_hosting_core-1.9.0.dev0 → microsoft_agents_hosting_core-1.9.0.dev3}/microsoft_agents/hosting/core/connector/client/connector_client.py

@@ -781,18 +781,17 @@ class ConnectorClient(ConnectorClientBase):
         if not endpoint.endswith("/"):
             endpoint += "/"
 
+        # Create session with the base URL
+        session = session or ClientSession(base_url=endpoint)
+
         # Configure headers with JSON acceptance
         headers = {
             "Accept": "application/json",
             "Content-Type": "application/json",
-            "User-Agent": get_product_info(),
+            "User-Agent": session.headers.get("User-Agent", get_product_info()),
         }
+        session.headers.update(headers)
 
-        # Create session with the base URL
-        session = session or ClientSession(
-            base_url=endpoint,
-            headers=headers,
-        )
         logger.debug(
             "ConnectorClient initialized with endpoint: %s and headers: %s",
             endpoint,

{microsoft_agents_hosting_core-1.9.0.dev0 → microsoft_agents_hosting_core-1.9.0.dev3}/microsoft_agents/hosting/core/connector/client/user_token_client.py

@@ -57,18 +57,16 @@ class UserTokenClient(UserTokenClientBase):
         if not endpoint.endswith("/"):
             endpoint += "/"
 
+        # Create session with the base URL
+        session = session or ClientSession(base_url=endpoint)
+
         # Configure headers with JSON acceptance
         headers = {
             "Accept": "application/json",
             "Content-Type": "application/json",
-            "User-Agent": get_product_info(),
+            "User-Agent": session.headers.get("User-Agent", get_product_info()),
         }
-
-        # Create session with the base URL
-        session = session or ClientSession(
-            base_url=endpoint,
-            headers=headers,
-        )
+        session.headers.update(headers)
         logger.debug(
             "Creating UserTokenClient with endpoint: %s and headers: %s",
             endpoint,

{microsoft_agents_hosting_core-1.9.0.dev0 → microsoft_agents_hosting_core-1.9.0.dev3}/microsoft_agents/hosting/core/connector/mcs/mcs_connector_client.py

@@ -14,6 +14,7 @@ from ..attachments_base import AttachmentsBase
 from ..conversations_base import ConversationsBase
 from ..client._base_client import _BaseClient
 from .._utils import _handle_request_error
+from ..get_product_info import get_product_info
 
 logger = logging.getLogger(__name__)
 
@@ -224,6 +225,13 @@ class MCSConnectorClient(ConnectorClientBase):
 
         self._endpoint = endpoint
         self._client = client or ClientSession()
+        headers = {
+            "Accept": "application/json",
+            "Content-Type": "application/json",
+            "User-Agent": self._client.headers.get("User-Agent", get_product_info()),
+        }
+        self._client.headers.update(headers)
+
         self._conversations = MCSConversations(self._client, self._endpoint)
         self._attachments = MCSAttachments()
 

microsoft_agents_hosting_core-1.9.0.dev3/microsoft_agents/hosting/core/security/__init__.py

@@ -0,0 +1,14 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+from ._connector import _SSRFError, _SSRFConnector
+from ._utils import _try_create_url, _normalize_host
+from .outbound_host_validator import OutboundHostValidator
+
+__all__ = [
+    "OutboundHostValidator",
+    "_SSRFError",
+    "_SSRFConnector",
+    "_try_create_url",
+    "_normalize_host",
+]

microsoft_agents_hosting_core-1.9.0.dev3/microsoft_agents/hosting/core/security/_connector.py

@@ -0,0 +1,58 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+from collections.abc import Sequence
+from typing import Protocol
+
+from aiohttp import TCPConnector
+from aiohttp.abc import ResolveResult
+from aiohttp.tracing import Trace
+
+
+class _ResolveResultValidator(Protocol):
+    """Protocol for validating resolved results to prevent SSRF attacks."""
+
+    def is_allowed(self, resolved: ResolveResult) -> bool:
+        """Check if the resolved result is valid to prevent SSRF attacks.
+
+        :param resolved: The resolved result to validate.
+        :return: True if the resolved result is valid, False otherwise.
+        """
+        ...
+
+
+class _SSRFError(ValueError):
+    """Exception raised when an SSRF attack is detected."""
+
+
+class _SSRFConnector(TCPConnector):
+    """TCPConnector subclass that validates resolved host results to prevent SSRF attacks."""
+
+    def __init__(
+        self, resolved_result_validator: _ResolveResultValidator, *args, **kwargs
+    ):
+        """Initialize the SSRFConnector with a resolved result validator.
+
+        :param resolved_result_validator: The validator used to check resolved host results.
+        """
+        super().__init__(*args, **kwargs)
+        self._resolved_result_validator = resolved_result_validator
+
+    async def _resolve_host(
+        self, host: str, port: int, traces: Sequence[Trace] | None = None
+    ) -> list[ResolveResult]:
+        """Resolve the host and validate the resolved results to prevent SSRF attacks.
+
+        :param host: The hostname to resolve.
+        :param port: The port number to resolve.
+        :param traces: Optional sequence of Trace objects for tracing the resolution process.
+        :return: A list of validated ResolveResult objects.
+        :raises _SSRFError: If any resolved result is invalid.
+        """
+
+        res = await super()._resolve_host(host, port, traces)
+
+        for r in res:
+            if not self._resolved_result_validator.is_allowed(r):
+                raise _SSRFError(f"Invalid resolved result: {r}")
+        return res

microsoft_agents_hosting_core-1.9.0.dev3/microsoft_agents/hosting/core/security/_middleware.py

@@ -0,0 +1,31 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+from typing import Callable, Awaitable
+
+from aiohttp import ClientRequest, ClientHandlerType, ClientResponse
+
+from ._connector import _SSRFError
+from ._validator import _URLValidator
+
+
+def _validator_middleware(
+    validator: _URLValidator,
+) -> Callable[[ClientRequest, ClientHandlerType], Awaitable[ClientResponse]]:
+    """Creates a middleware that validates outbound URLs using the given validator.
+
+    :param validator: The outbound host validator to use.
+    :return: A middleware function that validates outbound URLs.
+    """
+
+    async def _middleware(
+        req: ClientRequest, handler: ClientHandlerType
+    ) -> ClientResponse:
+        """Middleware that validates outbound URLs using the given host validator."""
+
+        if not validator.is_allowed(req.url):
+            raise _SSRFError(f"URL is not allowed by the outbound host validator.")
+
+        return await handler(req)
+
+    return _middleware