python-proxy-headers 0.2.3__py3-none-any.whl → 0.2.4__py3-none-any.whl

python_proxy_headers/header_utils.py

@@ -9,6 +9,7 @@ existing origin headers are never overwritten.
 from __future__ import annotations
 
 from typing import Any, Dict, List, Mapping, MutableMapping, Optional, Sequence, Tuple, Union
+from urllib.parse import urlparse
 
 RawHeaders = Union[Mapping[Any, Any], Sequence[Tuple[Any, Any]], None]
 
@@ -88,11 +89,11 @@ def validate_header_value(value: Any) -> str:
 
 
 def validate_headers(headers: Optional[Mapping[Any, Any]]) -> Dict[str, str]:
-	"""Validate a mapping of CONNECT request headers.
+	"""Validate a mapping of HTTP header names and values.
 
 	Raises:
 		ValueError: If any name or value contains CR, LF, NUL, or other
-			characters illegal in a single CONNECT header line.
+			characters illegal in a single header line.
 	"""
 	if not headers:
 		return {}
@@ -102,6 +103,43 @@ def validate_headers(headers: Optional[Mapping[Any, Any]]) -> Dict[str, str]:
 	return validated
 
 
+def validate_http_method(method: Any) -> str:
+	"""Return an HTTP method token, or raise ValueError if it is unsafe.
+
+	Methods must be a single token (no spaces, slashes, or control characters)
+	so they cannot smuggle extra request lines through CURLOPT_CUSTOMREQUEST.
+	"""
+	method_s = _as_str(method).upper()
+	if not method_s:
+		raise ValueError("HTTP method must not be empty")
+	for char in method_s:
+		code = ord(char)
+		if char in "()<>@,;:\\\"/[]?={} \t" or code <= 32 or code == 127:
+			raise ValueError(f"Invalid HTTP method {method_s!r}")
+	return method_s
+
+
+def validate_http_url(url: Any) -> str:
+	"""Return an http(s) URL, or raise ValueError for other schemes.
+
+	High-level HTTP helpers must not pass caller URLs to protocol-agile
+	backends such as libcurl, which otherwise honor ``file://`` and similar
+	schemes (and ignore an HTTP proxy for those schemes).
+	"""
+	url_s = _as_str(url)
+	if not url_s or any(char in url_s for char in "\r\n\x00"):
+		raise ValueError(f"Invalid URL {url_s!r}")
+	parsed = urlparse(url_s)
+	scheme = parsed.scheme.lower()
+	if scheme not in ("http", "https"):
+		raise ValueError(
+			f"Unsupported URL scheme {parsed.scheme!r}; only http and https are allowed"
+		)
+	if not parsed.netloc:
+		raise ValueError(f"URL must include a host: {url_s!r}")
+	return url_s
+
+
 def _header_items(headers: RawHeaders) -> List[Tuple[Any, Any]]:
 	if not headers:
 		return []

python_proxy_headers/pycurl_proxy.py

@@ -38,7 +38,7 @@ from io import BytesIO
 from dataclasses import dataclass, field
 from typing import Dict, List, Optional, Tuple
 
-from .header_utils import validate_headers
+from .header_utils import validate_headers, validate_http_method, validate_http_url
 
 try:
     import pycurl
@@ -263,6 +263,18 @@ class Response:
             raise Exception(f"HTTP Error {self.status_code}")
 
 
+def _restrict_http_protocols(curl) -> None:
+    """Limit libcurl to HTTP(S) so file:// and similar schemes cannot run."""
+    http_https = pycurl.PROTO_HTTP | pycurl.PROTO_HTTPS
+    curl.setopt(pycurl.PROTOCOLS, http_https)
+    redir_protocols = getattr(pycurl, "REDIR_PROTOCOLS", None)
+    if redir_protocols is not None:
+        try:
+            curl.setopt(redir_protocols, http_https)
+        except pycurl.error:
+            pass
+
+
 def request(
     method: str,
     url: str,
@@ -278,7 +290,7 @@ def request(
     
     Args:
         method: HTTP method (GET, POST, etc.)
-        url: Target URL
+        url: Target URL (http and https only)
         proxy: Proxy URL (e.g., 'http://user:pass@proxy:8080')
         proxy_headers: Headers to send to the proxy
         headers: Headers to send to the origin server
@@ -288,17 +300,25 @@ def request(
         
     Returns:
         Response object with body, headers, and proxy_headers
+
+    Raises:
+        ValueError: If the URL scheme is not http/https, the method is not a
+            single token, or a header name/value contains CR, LF, or NUL.
     """
+    url = validate_http_url(url)
+    method = validate_http_method(method)
+    headers = validate_headers(headers)
+
     c = pycurl.Curl()
     body = BytesIO()
     capture = HeaderCapture(c)
     
     try:
+        _restrict_http_protocols(c)
         c.setopt(pycurl.URL, url)
         c.setopt(pycurl.WRITEFUNCTION, body.write)
         
         # HTTP method
-        method = method.upper()
         if method == 'GET':
             c.setopt(pycurl.HTTPGET, 1)
         elif method == 'POST':

{python_proxy_headers-0.2.3.dist-info → python_proxy_headers-0.2.4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-proxy-headers
-Version: 0.2.3
+Version: 0.2.4
 Summary: Handle custom proxy headers for http & https requests in various python libraries
 Author-email: ProxyMesh <support@proxymesh.com>
 Project-URL: Homepage, https://github.com/proxymesh/python-proxy-headers

{python_proxy_headers-0.2.3.dist-info → python_proxy_headers-0.2.4.dist-info}/RECORD

@@ -2,13 +2,13 @@ python_proxy_headers/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hS
 python_proxy_headers/aiohttp_proxy.py,sha256=c6-MS6ldiLS5rxPmunrk9Z8-BkXryJOe6HNxbi3amo8,5256
 python_proxy_headers/autoscraper_proxy.py,sha256=wQoTE2akpbY2nXZWQvxmP5Ik2k8vSVd6ErYlz24YWCM,11415
 python_proxy_headers/cloudscraper_proxy.py,sha256=kdzqPHX_9Bf05EeV9jalbA5uqGEKdKXanyBV0y-N85E,8058
-python_proxy_headers/header_utils.py,sha256=EHX_XE2-6J2Q43LTy0u3lUFEmvJxYfzkUl0UBvh4Ttc,4552
+python_proxy_headers/header_utils.py,sha256=llAy606dwqEES4N60SLzSlB3ijdpcJVm7fnoNwdLtVY,5880
 python_proxy_headers/httpx_proxy.py,sha256=HxaKs-MWbxS6Jhxp0356OUvkT5Vun4Bab6G-NmfdhC0,12232
-python_proxy_headers/pycurl_proxy.py,sha256=2zy-KOioPzCdlGh9jbtynmyjxzvof5ey4d86vl5IxTM,11818
+python_proxy_headers/pycurl_proxy.py,sha256=Ogan8WT4cC5odifLbPXfct1twGy0JYbSmEkoRGwk9nM,12602
 python_proxy_headers/requests_adapter.py,sha256=ln3cXaWCHHMgL4uNlNrp9MDsocsFL68FuZ_Kyuj4U8U,2540
 python_proxy_headers/urllib3_proxy_manager.py,sha256=Yi_OlG5eZtQSPhj8-Tw7Y5hKmwCj8pApZn6fJARoOD8,5516
-python_proxy_headers-0.2.3.dist-info/licenses/LICENSE,sha256=i_H6fvudjqZOKkZFCIHGmbPHIxszjCAT90UJSY2OM0U,1066
-python_proxy_headers-0.2.3.dist-info/METADATA,sha256=oap_oG9q7mWY2tOUXZoU6Pl--N5evuANSIxjE-YH27Q,6288
-python_proxy_headers-0.2.3.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-python_proxy_headers-0.2.3.dist-info/top_level.txt,sha256=Bhm-Qc6vn0DAd2Li8ZBn6KLkls2zJnM4-CtXHvIiRh8,21
-python_proxy_headers-0.2.3.dist-info/RECORD,,
+python_proxy_headers-0.2.4.dist-info/licenses/LICENSE,sha256=i_H6fvudjqZOKkZFCIHGmbPHIxszjCAT90UJSY2OM0U,1066
+python_proxy_headers-0.2.4.dist-info/METADATA,sha256=T_Sy6rc2N8MsSIJXAAgYhb30n0utvdhlTEsxslW48r8,6288
+python_proxy_headers-0.2.4.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+python_proxy_headers-0.2.4.dist-info/top_level.txt,sha256=Bhm-Qc6vn0DAd2Li8ZBn6KLkls2zJnM4-CtXHvIiRh8,21
+python_proxy_headers-0.2.4.dist-info/RECORD,,

{python_proxy_headers-0.2.3.dist-info → python_proxy_headers-0.2.4.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (84.0.0)
+Generator: setuptools (84.2.1)
 Root-Is-Purelib: true
 Tag: py3-none-any