pygeoapi 0.23.2__tar.gz → 0.23.4__tar.gz

{pygeoapi-0.23.2/pygeoapi.egg-info → pygeoapi-0.23.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pygeoapi
-Version: 0.23.2
+Version: 0.23.4
 Summary: pygeoapi provides an API to geospatial data
 Home-page: https://pygeoapi.io
 Author: Tom Kralidis
@@ -20,24 +20,24 @@ Classifier: Topic :: Scientific/Engineering :: GIS
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE.md
-Requires-Dist: Babel==2.10.3
-Requires-Dist: click==8.1.6
-Requires-Dist: filelock==3.25.0
-Requires-Dist: Flask==3.1.3
-Requires-Dist: jinja2==3.1.2
-Requires-Dist: jsonschema==4.26.0
-Requires-Dist: pydantic==1.10.14
-Requires-Dist: pygeofilter==0.3.3
-Requires-Dist: pygeoif==1.6.0
-Requires-Dist: pyproj==3.6.1
-Requires-Dist: python-dateutil==2.8.2
-Requires-Dist: pytz==2026.1.post1
-Requires-Dist: PyYAML==6.0.1
-Requires-Dist: rasterio==1.3.9
-Requires-Dist: requests==2.31.0
-Requires-Dist: shapely==2.0.3
-Requires-Dist: SQLAlchemy==2.0.48
-Requires-Dist: tinydb==3.15.2
+Requires-Dist: Babel
+Requires-Dist: click
+Requires-Dist: filelock
+Requires-Dist: Flask
+Requires-Dist: jinja2
+Requires-Dist: jsonschema
+Requires-Dist: pydantic
+Requires-Dist: pygeofilter
+Requires-Dist: pygeoif
+Requires-Dist: pyproj
+Requires-Dist: python-dateutil
+Requires-Dist: pytz
+Requires-Dist: PyYAML
+Requires-Dist: rasterio
+Requires-Dist: requests
+Requires-Dist: shapely
+Requires-Dist: SQLAlchemy
+Requires-Dist: tinydb
 Dynamic: author
 Dynamic: author-email
 Dynamic: classifier

{pygeoapi-0.23.2 → pygeoapi-0.23.4}/pygeoapi/__init__.py

@@ -30,7 +30,7 @@
 #
 # =================================================================
 
-__version__ = '0.23.2'
+__version__ = '0.23.4'
 
 import click
 try:

{pygeoapi-0.23.2 → pygeoapi-0.23.4}/pygeoapi/process/base.py

@@ -3,7 +3,7 @@
 # Authors: Tom Kralidis <tomkralidis@gmail.com>
 #          Francesco Martinelli <francesco.martinelli@ingv.it>
 #
-# Copyright (c) 2022 Tom Kralidis
+# Copyright (c) 2026 Tom Kralidis
 # Copyright (c) 2024 Francesco Martinelli
 #
 # Permission is hereby granted, free of charge, to any person
@@ -53,6 +53,8 @@ class BaseProcessor:
         self.name = processor_def['name']
         self.metadata = process_metadata
         self.supports_outputs = False
+        self.allow_internal_requests = processor_def.get(
+            'allow_internal_requests', False)
 
     def set_job_id(self, job_id: str) -> None:
         """

{pygeoapi-0.23.2 → pygeoapi-0.23.4}/pygeoapi/process/manager/base.py

@@ -46,10 +46,12 @@ from pygeoapi.process.base import (
     BaseProcessor,
     JobNotFoundError,
     JobResultNotFoundError,
+    ProcessorExecuteError,
     UnknownProcessError,
 )
 from pygeoapi.util import (
     get_current_datetime,
+    is_request_allowed,
     JobStatus,
     ProcessExecutionMode,
     RequestedProcessExecutionMode,
@@ -105,7 +107,11 @@ class BaseManager:
         except KeyError as err:
             raise UnknownProcessError('Invalid process identifier') from err
         else:
-            return load_plugin('process', process_conf['processor'])
+            pp = load_plugin('process', process_conf['processor'])
+            pp.allow_internal_requests = process_conf.get(
+                'allow_internal_requests', False)
+
+            return pp
 
     def get_jobs(self,
                  status: JobStatus = None,
@@ -394,13 +400,13 @@ class BaseManager:
         """
 
         job_id = str(uuid.uuid1())
-        processor = self.get_processor(process_id)
-        processor.set_job_id(job_id)
+        self.processor = self.get_processor(process_id)
+        self.processor.set_job_id(job_id)
         extra_execute_handler_parameters = {
             'requested_response': requested_response
         }
 
-        job_control_options = processor.metadata.get(
+        job_control_options = self.processor.metadata.get(
             'jobControlOptions', [])
 
         if execution_mode == RequestedProcessExecutionMode.respond_async:
@@ -473,7 +479,7 @@ class BaseManager:
         # TODO: handler's response could also be allowed to include more HTTP
         # headers
         mime_type, outputs, status = handler(
-            processor,
+            self.processor,
             job_id,
             data_dict,
             requested_outputs,
@@ -483,26 +489,37 @@ class BaseManager:
 
     def _send_in_progress_notification(self, subscriber: Optional[Subscriber]):
         if subscriber and subscriber.in_progress_uri:
-            response = requests.post(subscriber.in_progress_uri, json={})
-            LOGGER.debug(
-                f'In progress notification response: {response.status_code}'
-            )
+            self.__do_subscriber_request(subscriber.in_progress_uri)
 
     def _send_success_notification(
             self, subscriber: Optional[Subscriber], outputs: Any
     ):
-        if subscriber:
-            response = requests.post(subscriber.success_uri, json=outputs)
-            LOGGER.debug(
-                f'Success notification response: {response.status_code}'
-            )
+        if subscriber and subscriber.success_uri:
+            self.__do_subscriber_request(subscriber.success_uri, outputs)
 
     def _send_failed_notification(self, subscriber: Optional[Subscriber]):
         if subscriber and subscriber.failed_uri:
-            response = requests.post(subscriber.failed_uri, json={})
-            LOGGER.debug(
-                f'Failed notification response: {response.status_code}'
-            )
+            self.__do_subscriber_request(subscriber.failed_uri)
+
+    def __do_subscriber_request(self, url: str, data: dict = {}) -> None:
+        """
+        Helper function to execute a subscriber URL via HTTP POST
+
+        :param url: `str` of URL
+        :param data: `dict` of request payload
+
+        :returns: `None`
+        """
+
+        if not is_request_allowed(url, self.processor.allow_internal_requests):
+            msg = 'URL not allowed'
+            LOGGER.error(f'{msg}: {url}')
+            raise ProcessorExecuteError(msg)
+
+        response = requests.post(url, json=data)
+        LOGGER.debug(
+            f'Response: {response.status_code}'
+        )
 
     def __repr__(self):
         return f'<BaseManager> {self.name}'

{pygeoapi-0.23.2 → pygeoapi-0.23.4}/pygeoapi/provider/filesystem.py

@@ -2,7 +2,7 @@
 #
 # Authors: Tom Kralidis <tomkralidis@gmail.com>
 #
-# Copyright (c) 2023 Tom Kralidis
+# Copyright (c) 2026 Tom Kralidis
 #
 # Permission is hereby granted, free of charge, to any person
 # obtaining a copy of this software and associated documentation
@@ -34,6 +34,7 @@ import logging
 import os
 
 from pygeoapi.provider.base import (BaseProvider, ProviderConnectionError,
+                                    ProviderInvalidQueryError,
                                     ProviderNotFoundError)
 from pygeoapi.util import file_modified_iso8601, get_path_basename, url_join
 
@@ -76,9 +77,15 @@ class FileSystemProvider(BaseProvider):
         root_link = None
         child_links = []
 
-        data_path = os.path.join(self.data, dirpath)
+        if '..' in dirpath:
+            msg = 'Invalid path requested'
+            LOGGER.error(f'{msg}: {dirpath}')
+            raise ProviderInvalidQueryError(msg)
+
         data_path = self.data + dirpath
 
+        LOGGER.debug(f'Data path: {data_path}')
+
         if '/' not in dirpath:  # root
             root_link = baseurl
         else:

{pygeoapi-0.23.2 → pygeoapi-0.23.4}/pygeoapi/resources/schemas/config/pygeoapi-config-0.x.yml

@@ -682,7 +682,11 @@ properties:
                                           For custom built plugins, use the import path (e.g. `mypackage.provider.MyProvider`)
                               required:
                                   - name
-                      required:
+                          allow_internal_requests:
+                              type: boolean
+                              description: whether to allow internal HTTP requests
+                              default: false
+                      requred:
                           - type
                           - processor
 definitions:

{pygeoapi-0.23.2 → pygeoapi-0.23.4}/pygeoapi/util.py

@@ -36,6 +36,7 @@ from datetime import date, datetime, time, timezone
 from decimal import Decimal
 from enum import Enum
 from heapq import heappush
+import ipaddress
 import json
 import logging
 import mimetypes
@@ -43,6 +44,7 @@ import os
 import pathlib
 from pathlib import Path
 import re
+import socket
 from typing import Any, IO, Union, List, Optional
 from urllib.parse import urlparse
 from urllib.request import urlopen
@@ -754,3 +756,30 @@ def remove_url_auth(url: str) -> str:
     u = urlparse(url)
     auth = f'{u.username}:{u.password}@'
     return url.replace(auth, '')
+
+
+def is_request_allowed(url: str, allow_internal: bool = False) -> bool:
+    """
+    Test whether an HTTP request is allowed to be executed
+
+    :param url: `str` of URL
+    :param allow_internal: `bool` of whether internal requests are
+                           allowed (default `False`)
+
+    :returns: `bool` of whether HTTP request execution is allowed
+    """
+
+    is_allowed = False
+
+    u = urlparse(url)
+
+    ip = socket.gethostbyname(u.hostname)
+
+    is_private = ipaddress.ip_address(ip).is_private
+
+    if not is_private:
+        is_allowed = True
+    if is_private and allow_internal:
+        is_allowed = True
+
+    return is_allowed

{pygeoapi-0.23.2 → pygeoapi-0.23.4/pygeoapi.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pygeoapi
-Version: 0.23.2
+Version: 0.23.4
 Summary: pygeoapi provides an API to geospatial data
 Home-page: https://pygeoapi.io
 Author: Tom Kralidis
@@ -20,24 +20,24 @@ Classifier: Topic :: Scientific/Engineering :: GIS
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE.md
-Requires-Dist: Babel==2.10.3
-Requires-Dist: click==8.1.6
-Requires-Dist: filelock==3.25.0
-Requires-Dist: Flask==3.1.3
-Requires-Dist: jinja2==3.1.2
-Requires-Dist: jsonschema==4.26.0
-Requires-Dist: pydantic==1.10.14
-Requires-Dist: pygeofilter==0.3.3
-Requires-Dist: pygeoif==1.6.0
-Requires-Dist: pyproj==3.6.1
-Requires-Dist: python-dateutil==2.8.2
-Requires-Dist: pytz==2026.1.post1
-Requires-Dist: PyYAML==6.0.1
-Requires-Dist: rasterio==1.3.9
-Requires-Dist: requests==2.31.0
-Requires-Dist: shapely==2.0.3
-Requires-Dist: SQLAlchemy==2.0.48
-Requires-Dist: tinydb==3.15.2
+Requires-Dist: Babel
+Requires-Dist: click
+Requires-Dist: filelock
+Requires-Dist: Flask
+Requires-Dist: jinja2
+Requires-Dist: jsonschema
+Requires-Dist: pydantic
+Requires-Dist: pygeofilter
+Requires-Dist: pygeoif
+Requires-Dist: pyproj
+Requires-Dist: python-dateutil
+Requires-Dist: pytz
+Requires-Dist: PyYAML
+Requires-Dist: rasterio
+Requires-Dist: requests
+Requires-Dist: shapely
+Requires-Dist: SQLAlchemy
+Requires-Dist: tinydb
 Dynamic: author
 Dynamic: author-email
 Dynamic: classifier

pygeoapi-0.23.4/pygeoapi.egg-info/requires.txt

@@ -0,0 +1,18 @@
+Babel
+click
+filelock
+Flask
+jinja2
+jsonschema
+pydantic
+pygeofilter
+pygeoif
+pyproj
+python-dateutil
+pytz
+PyYAML
+rasterio
+requests
+shapely
+SQLAlchemy
+tinydb

pygeoapi-0.23.4/requirements.txt

@@ -0,0 +1,18 @@
+Babel
+click
+filelock
+Flask
+jinja2
+jsonschema
+pydantic
+pygeofilter
+pygeoif
+pyproj
+python-dateutil
+pytz
+PyYAML
+rasterio
+requests
+shapely
+SQLAlchemy
+tinydb

{pygeoapi-0.23.2 → pygeoapi-0.23.4}/tests/other/test_util.py

@@ -2,7 +2,7 @@
 #
 # Authors: Tom Kralidis <tomkralidis@gmail.com>
 #
-# Copyright (c) 2025 Tom Kralidis
+# Copyright (c) 2026 Tom Kralidis
 #
 # Permission is hereby granted, free of charge, to any person
 # obtaining a copy of this software and associated documentation
@@ -321,3 +321,21 @@ def test_get_choice_from_headers():
                                         'accept') == 'application/ld+json'
     assert util.get_choice_from_headers(
         {'accept-language': 'en_US', 'accept': '*/*'}, 'accept') == '*/*'
+
+
+@pytest.mark.parametrize('url,allow_internal,result', [
+    ['http://127.0.0.1/test', False, False],
+    ['http://127.0.0.1/test', True, True],
+    ['http://192.168.0.12/test', False, False],
+    ['http://192.168.0.12/test', True, True],
+    ['http://169.254.0.11/test', False, False],
+    ['http://169.254.0.11/test', True, True],
+    ['http://0.0.0.0/test', True, True],
+    ['http://0.0.0.0/test', False, False],
+    ['http://localhost:5000/test', False, False],
+    ['http://localhost:5000/test', True, True],
+    ['https://pygeoapi.io', False, True],
+    ['https://pygeoapi.io', True, True]
+])
+def test_is_request_allowed(url, allow_internal, result):
+    assert util.is_request_allowed(url, allow_internal) is result

{pygeoapi-0.23.2 → pygeoapi-0.23.4}/tests/provider/test_filesystem_provider.py

@@ -2,7 +2,7 @@
 #
 # Authors: Tom Kralidis <tomkralidis@gmail.com>
 #
-# Copyright (c) 2021 Tom Kralidis
+# Copyright (c) 2026 Tom Kralidis
 #
 # Permission is hereby granted, free of charge, to any person
 # obtaining a copy of this software and associated documentation
@@ -30,6 +30,7 @@
 import os
 import pytest
 
+from pygeoapi.provider.base import ProviderInvalidQueryError
 from pygeoapi.provider.filesystem import FileSystemProvider
 
 THISDIR = os.path.dirname(os.path.realpath(__file__))
@@ -73,3 +74,6 @@ def test_query(config):
         'osm_id': 'int'
     }
     assert r['assets']['default']['href'] == 'http://example.org/stac/poi_portugal.gpkg'  # noqa
+
+    with pytest.raises(ProviderInvalidQueryError):
+        _ = p.get_data_path(baseurl, urlpath, '../../poi_portugal')

pygeoapi-0.23.2/pygeoapi.egg-info/requires.txt

@@ -1,18 +0,0 @@
-Babel==2.10.3
-click==8.1.6
-filelock==3.25.0
-Flask==3.1.3
-jinja2==3.1.2
-jsonschema==4.26.0
-pydantic==1.10.14
-pygeofilter==0.3.3
-pygeoif==1.6.0
-pyproj==3.6.1
-python-dateutil==2.8.2
-pytz==2026.1.post1
-PyYAML==6.0.1
-rasterio==1.3.9
-requests==2.31.0
-shapely==2.0.3
-SQLAlchemy==2.0.48
-tinydb==3.15.2

pygeoapi-0.23.2/requirements.txt

@@ -1,18 +0,0 @@
-Babel==2.10.3
-click==8.1.6
-filelock==3.25.0
-Flask==3.1.3
-jinja2==3.1.2
-jsonschema==4.26.0
-pydantic==1.10.14
-pygeofilter==0.3.3
-pygeoif==1.6.0
-pyproj==3.6.1
-python-dateutil==2.8.2
-pytz==2026.1.post1
-PyYAML==6.0.1
-rasterio==1.3.9
-requests==2.31.0
-shapely==2.0.3
-SQLAlchemy==2.0.48
-tinydb==3.15.2