prefect-client 2.20.10__py3-none-any.whl → 2.20.11__py3-none-any.whl

prefect/blocks/notifications.py

@@ -4,6 +4,7 @@ from typing import Dict, List, Optional
 
 from prefect._internal.pydantic import HAS_PYDANTIC_V2
 from prefect.logging import LogEavesdropper
+from prefect.utilities.urls import validate_restricted_url
 
 if HAS_PYDANTIC_V2:
     from pydantic.v1 import AnyHttpUrl, Field, SecretStr
@@ -88,6 +89,26 @@ class AppriseNotificationBlock(AbstractAppriseNotificationBlock, ABC):
         description="Incoming webhook URL used to send notifications.",
         examples=["https://hooks.example.com/XXX"],
     )
+    allow_private_urls: bool = Field(
+        default=True,
+        description="Whether to allow notifications to private URLs. Defaults to True.",
+    )
+
+    @sync_compatible
+    async def notify(
+        self,
+        body: str,
+        subject: Optional[str] = None,
+    ):
+        if not self.allow_private_urls:
+            try:
+                validate_restricted_url(self.url.get_secret_value())
+            except ValueError as exc:
+                if self._raise_on_failure:
+                    raise NotificationError(str(exc))
+                raise
+
+        await super().notify(body, subject)
 
 
 # TODO: Move to prefect-slack once collection block auto-registration is

prefect/blocks/webhook.py

@@ -3,6 +3,7 @@ from typing import Optional
 from httpx import AsyncClient, AsyncHTTPTransport, Response
 
 from prefect._internal.pydantic import HAS_PYDANTIC_V2
+from prefect.utilities.urls import validate_restricted_url
 
 if HAS_PYDANTIC_V2:
     from pydantic.v1 import Field, SecretStr
@@ -38,7 +39,10 @@ class Webhook(Block):
         description="The webhook URL.",
         examples=["https://hooks.slack.com/XXX"],
     )
-
+    allow_private_urls: bool = Field(
+        default=True,
+        description="Whether to allow notifications to private URLs. Defaults to True.",
+    )
     headers: SecretDict = Field(
         default_factory=lambda: SecretDict(dict()),
         title="Webhook Headers",
@@ -55,6 +59,9 @@ class Webhook(Block):
         Args:
             payload: an optional payload to send when calling the webhook.
         """
+        if not self.allow_private_urls:
+            validate_restricted_url(self.url.get_secret_value())
+
         async with self._client:
             return await self._client.request(
                 method=self.method,

prefect/utilities/urls.py

@@ -0,0 +1,49 @@
+import ipaddress
+import socket
+from urllib.parse import urlparse
+
+
+def validate_restricted_url(url: str):
+    """
+    Validate that the provided URL is safe for outbound requests.  This prevents
+    attacks like SSRF (Server Side Request Forgery), where an attacker can make
+    requests to internal services (like the GCP metadata service, localhost addresses,
+    or in-cluster Kubernetes services)
+    Args:
+        url: The URL to validate.
+    Raises:
+        ValueError: If the URL is a restricted URL.
+    """
+
+    try:
+        parsed_url = urlparse(url)
+    except ValueError:
+        raise ValueError(f"{url!r} is not a valid URL.")
+
+    if parsed_url.scheme not in ("http", "https"):
+        raise ValueError(
+            f"{url!r} is not a valid URL.  Only HTTP and HTTPS URLs are allowed."
+        )
+
+    hostname = parsed_url.hostname or ""
+
+    # Remove IPv6 brackets if present
+    if hostname.startswith("[") and hostname.endswith("]"):
+        hostname = hostname[1:-1]
+
+    if not hostname:
+        raise ValueError(f"{url!r} is not a valid URL.")
+
+    try:
+        ip_address = socket.gethostbyname(hostname)
+        ip = ipaddress.ip_address(ip_address)
+    except socket.gaierror:
+        try:
+            ip = ipaddress.ip_address(hostname)
+        except ValueError:
+            raise ValueError(f"{url!r} is not a valid URL.  It could not be resolved.")
+
+    if ip.is_private:
+        raise ValueError(
+            f"{url!r} is not a valid URL.  It resolves to the private address {ip}."
+        )

prefect/workers/base.py

@@ -137,6 +137,12 @@ class BaseJobConfiguration(BaseModel):
         variables = cls._get_base_config_defaults(
             variables_schema.get("properties", {})
         )
+
+        # copy variable defaults for `env` to job config before they're replaced by
+        # deployment overrides
+        if variables.get("env"):
+            job_config["env"] = variables.get("env")
+
         variables.update(values)
 
         # deep merge `env`

{prefect_client-2.20.10.dist-info → prefect_client-2.20.11.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: prefect-client
-Version: 2.20.10
+Version: 2.20.11
 Summary: Workflow orchestration and management.
 Home-page: https://www.prefect.io
 Author: Prefect Technologies, Inc.
@@ -22,7 +22,7 @@ Classifier: Topic :: Software Development :: Libraries
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: anyio<5.0.0,>=4.4.0
+Requires-Dist: anyio<4.6.1,>=4.4.0
 Requires-Dist: asgi-lifespan<3.0,>=1.0
 Requires-Dist: cachetools<6.0,>=5.3
 Requires-Dist: cloudpickle<4.0,>=2.0

{prefect_client-2.20.10.dist-info → prefect_client-2.20.11.dist-info}/RECORD

@@ -159,9 +159,9 @@ prefect/blocks/abstract.py,sha256=AiAs0MC5JKCf0Xg0yofC5Qu2TZ52AjDMP1ntMGuP2dY,16
 prefect/blocks/core.py,sha256=_NKdrHvN2f0LdgqX9MYXp0PJQW36e6cs2Za7hVfrCIw,43870
 prefect/blocks/fields.py,sha256=ANOzbNyDCBIvm6ktgbLTMs7JW2Sf6CruyATjAW61ks0,1607
 prefect/blocks/kubernetes.py,sha256=IN-hZkzIRvqjd_dzPZby3q8p7m2oUWqArBq24BU9cDg,4071
-prefect/blocks/notifications.py,sha256=vdGxLBh1VNicoI8G2bZk0X55mQB1DqVuej7xiCec8pM,28822
+prefect/blocks/notifications.py,sha256=EMW38ZGkQERQHJ32zkqod_GkFIJssq5ra5_rpRZOc_c,29487
 prefect/blocks/system.py,sha256=aIRiFKlXIQ1sMaqniMXYolFsx2IVN3taBMH3KCThB2I,3089
-prefect/blocks/webhook.py,sha256=VzQ-qcRtW8MMuYEGYwFgt1QXtWedUtVmeTo7iE2UQ78,2008
+prefect/blocks/webhook.py,sha256=iyPkhgTL04oqz7R2I0jddS2oBWVdp7qvBlRxEbbwueo,2327
 prefect/client/__init__.py,sha256=yJ5FRF9RxNUio2V_HmyKCKw5G6CZO0h8cv6xA_Hkpcc,477
 prefect/client/base.py,sha256=YSPeE7hV0NCuD6WzoAACDYGFK4Yq35d26pITZ3elNyY,24669
 prefect/client/cloud.py,sha256=E54OAFr7bY5IXhhMBdjGwLQiR0eU-WWFoEEiOq2l53I,4104
@@ -278,18 +278,19 @@ prefect/utilities/slugify.py,sha256=57Vb14t13F3zm1P65KAu8nVeAz0iJCd1Qc5eMG-R5y8,
 prefect/utilities/templating.py,sha256=t32Gcsvvm8ibzdqXwcWzY7JkwftPn73FiiLYEnQWyKM,13237
 prefect/utilities/text.py,sha256=eXGIsCcZ7h_6hy8T5GDQjL8GiKyktoOqavYub0QjgO4,445
 prefect/utilities/timeout.py,sha256=nxmuPxROIT-i8gPffpARuxnxu58H0vkmbjTVIgef0_0,805
+prefect/utilities/urls.py,sha256=sxv2lG8u3tX_zPZp66qEAFgZmGreG_D_9jGAqqYqaKc,1522
 prefect/utilities/visualization.py,sha256=9Pc8ImgnBpnszWTFxYm42cmtHjNEAsGZ8ugkn8w_dJk,6501
 prefect/utilities/schema_tools/__init__.py,sha256=KsFsTEHQqgp89TkDpjggkgBBywoHQPxbx-m6YQhiNEI,322
 prefect/utilities/schema_tools/hydration.py,sha256=RNuJK4Vd__V69gdQbaWSVhSkV0AUISfGzH_xd0p6Zh0,8291
 prefect/utilities/schema_tools/validation.py,sha256=zZHL_UFxAlgaUzi-qsEOrhWtZ7EkFQvPkX_YN1EJNTo,8414
 prefect/workers/__init__.py,sha256=6el2Q856CuRPa5Hdrbm9QyAWB_ovcT2bImSFsoWI46k,66
-prefect/workers/base.py,sha256=LNcVu0FIDBYv2XnWH1a2uV2Yyngtlyq8_pvLC4dxbrc,45576
+prefect/workers/base.py,sha256=r0kM2EbT69yQsd3L7Lq99IqaBHhZgc6tcpdh3YekSJY,45779
 prefect/workers/block.py,sha256=aYY__uq3v1eq1kkbVukxyhQNbkknaKYo6-_3tcrfKKA,8067
 prefect/workers/process.py,sha256=pPtCdA7fKQ4OsvoitT-cayZeh5HgLX4xBUYlb2Zad-Q,9475
 prefect/workers/server.py,sha256=WVZJxR8nTMzK0ov0BD0xw5OyQpT26AxlXbsGQ1OrxeQ,1551
 prefect/workers/utilities.py,sha256=VfPfAlGtTuDj0-Kb8WlMgAuOfgXCdrGAnKMapPSBrwc,2483
-prefect_client-2.20.10.dist-info/LICENSE,sha256=MCxsn8osAkzfxKC4CC_dLcUkU8DZLkyihZ8mGs3Ah3Q,11357
-prefect_client-2.20.10.dist-info/METADATA,sha256=AWEDtW-Rm_YudnjrVA3gBSllWBa0d_EVfiMwpcVDodI,7392
-prefect_client-2.20.10.dist-info/WHEEL,sha256=OVMc5UfuAQiSplgO0_WdW7vXVGAt9Hdd6qtN4HotdyA,91
-prefect_client-2.20.10.dist-info/top_level.txt,sha256=MJZYJgFdbRc2woQCeB4vM6T33tr01TmkEhRcns6H_H4,8
-prefect_client-2.20.10.dist-info/RECORD,,
+prefect_client-2.20.11.dist-info/LICENSE,sha256=MCxsn8osAkzfxKC4CC_dLcUkU8DZLkyihZ8mGs3Ah3Q,11357
+prefect_client-2.20.11.dist-info/METADATA,sha256=YMdpw_0mas-4W0mXLs8FpuoyxKW-PlSvCxwdHPi0ArA,7392
+prefect_client-2.20.11.dist-info/WHEEL,sha256=P9jw-gEje8ByB7_hXoICnHtVCrEwMQh-630tKvQWehc,91
+prefect_client-2.20.11.dist-info/top_level.txt,sha256=MJZYJgFdbRc2woQCeB4vM6T33tr01TmkEhRcns6H_H4,8
+prefect_client-2.20.11.dist-info/RECORD,,

{prefect_client-2.20.10.dist-info → prefect_client-2.20.11.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (75.2.0)
+Generator: setuptools (75.3.0)
 Root-Is-Purelib: true
 Tag: py3-none-any