streamlit-data-editor-plus 0.1.0__py3-none-any.whl

streamlit/navigation/page.py

@@ -0,0 +1,365 @@
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2026)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from __future__ import annotations
+
+import types
+from pathlib import Path
+from typing import TYPE_CHECKING, Literal
+
+from streamlit.errors import StreamlitAPIException, StreamlitValueError
+from streamlit.runtime.metrics_util import gather_metrics
+from streamlit.runtime.scriptrunner_utils.script_run_context import get_script_run_ctx
+from streamlit.source_util import page_icon_and_name
+from streamlit.string_util import validate_icon_or_emoji
+from streamlit.util import calc_md5
+
+if TYPE_CHECKING:
+    from collections.abc import Callable
+
+
+@gather_metrics("Page")
+def Page(  # noqa: N802
+    page: str | Path | Callable[[], None],
+    *,
+    title: str | None = None,
+    icon: str | None = None,
+    url_path: str | None = None,
+    default: bool = False,
+    visibility: Literal["visible", "hidden"] = "visible",
+) -> StreamlitPage:
+    """Configure a page for ``st.navigation`` in a multipage app.
+
+    Call ``st.Page`` to initialize a ``StreamlitPage`` object, and pass it to
+    ``st.navigation`` to declare a page in your app.
+
+    When a user navigates to a page, ``st.navigation`` returns the selected
+    ``StreamlitPage`` object. Call ``.run()`` on the returned ``StreamlitPage``
+    object to execute the page. You can only run the page returned by
+    ``st.navigation``, and you can only run it once per app rerun.
+
+    A page can be defined by a Python file or ``Callable``.
+
+    Parameters
+    ----------
+    page : str, Path, or callable
+        The page source as a ``Callable`` or path to a Python file. If the page
+        source is defined by a Python file, the path can be a string or
+        ``pathlib.Path`` object. Paths can be absolute or relative to the
+        entrypoint file. If the page source is defined by a ``Callable``, the
+        ``Callable`` can't accept arguments.
+
+    title : str or None
+        The title of the page. If this is ``None`` (default), the page title
+        (in the browser tab) and label (in the navigation menu) will be
+        inferred from the filename or callable name in ``page``. For more
+        information, see `Overview of multipage apps
+        <https://docs.streamlit.io/st.page.automatic-page-labels>`_.
+
+        The title supports GitHub-flavored Markdown. The following elements
+        are supported: **bold**, *italics*, ~strikethroughs~, ``inline code``,
+        :material/thumb_up: Material icons, and images. Unsupported elements
+        are unwrapped so only their text content renders.
+
+    icon : str or None
+        An optional emoji or icon to display next to the page title and label.
+        If ``icon`` is ``None`` (default), no icon is displayed next to the
+        page label in the navigation menu, and a Streamlit icon is displayed
+        next to the title (in the browser tab). If ``icon`` is a string, the
+        following options are valid:
+
+        - A single-character emoji. For example, you can set ``icon="🚨"``
+            or ``icon="🔥"``. Emoji short codes are not supported.
+
+        - An icon from the Material Symbols library (rounded style) in the
+            format ``":material/icon_name:"`` where "icon_name" is the name
+            of the icon in snake case.
+
+            For example, ``icon=":material/thumb_up:"`` will display the
+            Thumb Up icon. Find additional icons in the `Material Symbols \
+            <https://fonts.google.com/icons?icon.set=Material+Symbols&icon.style=Rounded>`_
+            font library.
+
+        - ``"spinner"``: Displays a spinner as an icon. In this case, the
+          spinner only displays next to the page label in the navigation menu.
+          The spinner isn't used as the page favicon next to the title in the
+          browser tab. The favicon is the default Streamlit icon unless
+          otherwise specified with the ``page_icon`` parameter of
+          ``st.set_page_config``.
+
+    url_path : str or None
+        The page's URL pathname, which is the path relative to the app's root
+        URL. If this is ``None`` (default), the URL pathname will be inferred
+        from the filename or callable name in ``page``. For more information,
+        see `Overview of multipage apps
+        <https://docs.streamlit.io/st.page.automatic-page-urls>`_.
+
+        The default page will have a pathname of ``""``, indicating the root
+        URL of the app. If you set ``default=True``, ``url_path`` is ignored.
+        ``url_path`` can't include forward slashes; paths can't include
+        subdirectories.
+
+    default : bool
+        Whether this page is the default page to be shown when the app is
+        loaded. If ``default`` is ``False`` (default), the page will have a
+        nonempty URL pathname. However, if no default page is passed to
+        ``st.navigation`` and this is the first page, this page will become the
+        default page. If ``default`` is ``True``, then the page will have
+        an empty pathname and ``url_path`` will be ignored.
+
+    visibility : "visible" or "hidden"
+        Whether the page is shown in the navigation menu. If ``"visible"``
+        (default), the page appears in the navigation menu. If ``"hidden"``,
+        the page is excluded from the navigation menu but remains accessible
+        via direct URL, ``st.page_link``, or ``st.switch_page``.
+
+    Returns
+    -------
+    StreamlitPage
+        The page object associated to the given script.
+
+    Example
+    -------
+    >>> import streamlit as st
+    >>>
+    >>> def page2():
+    >>>     st.title("Second page")
+    >>>
+    >>> pg = st.navigation([
+    >>>     st.Page("page1.py", title="First page", icon="🔥"),
+    >>>     st.Page(page2, title="Second page", icon=":material/favorite:"),
+    >>> ])
+    >>> pg.run()
+    """
+    return StreamlitPage(
+        page,
+        title=title,
+        icon=icon,
+        url_path=url_path,
+        default=default,
+        visibility=visibility,
+    )
+
+
+class StreamlitPage:
+    """A page within a multipage Streamlit app.
+
+    Use ``st.Page`` to initialize a ``StreamlitPage`` object.
+
+    Attributes
+    ----------
+    icon : str
+        The icon of the page.
+
+        If no icon was declared in ``st.Page``, this property returns ``""``.
+
+    title : str
+        The title of the page.
+
+        Unless declared otherwise in ``st.Page``, the page title is inferred
+        from the filename or callable name. For more information, see
+        `Overview of multipage apps
+        <https://docs.streamlit.io/st.page.automatic-page-labels>`_.
+
+        The title supports GitHub-flavored Markdown with restricted elements
+        (bold, italics, strikethroughs, inline code, Material icons, and
+        images).
+
+    url_path : str
+        The page's URL pathname, which is the path relative to the app's root
+        URL.
+
+        Unless declared otherwise in ``st.Page``, the URL pathname is inferred
+        from the filename or callable name. For more information, see
+        `Overview of multipage apps
+        <https://docs.streamlit.io/st.page.automatic-page-urls>`_.
+
+        The default page will always have a ``url_path`` of ``""`` to indicate
+        the root URL (e.g. homepage).
+
+    visibility : Literal["visible", "hidden"]
+        The visibility of the page in the navigation menu.
+
+        This property returns ``"visible"`` (default) or ``"hidden"``.
+        Hidden pages are not shown in the navigation menu but can still
+        be accessed via URL or programmatically.
+
+    """
+
+    def __init__(
+        self,
+        page: str | Path | Callable[[], None],
+        *,
+        title: str | None = None,
+        icon: str | None = None,
+        url_path: str | None = None,
+        default: bool = False,
+        visibility: Literal["visible", "hidden"] = "visible",
+    ) -> None:
+        # Must appear before the return so all pages, even if running in bare Python,
+        # have a _default property. This way we can always tell which script needs to run.
+        self._default: bool = default
+
+        # Validate and store visibility before potential early return
+        if visibility not in {"visible", "hidden"}:
+            raise StreamlitValueError("visibility", ["visible", "hidden"])
+        self._visibility: Literal["visible", "hidden"] = visibility
+
+        ctx = get_script_run_ctx()
+        if not ctx:
+            return
+
+        main_path = ctx.pages_manager.main_script_parent
+        if isinstance(page, str):
+            page = Path(page)
+        if isinstance(page, Path):
+            page = (main_path / page).resolve()
+
+            if not page.is_file():
+                raise StreamlitAPIException(
+                    f"Unable to create Page. The file `{page.name}` could not be found."
+                )
+
+        inferred_name = ""
+        inferred_icon = ""
+        if isinstance(page, Path):
+            inferred_icon, inferred_name = page_icon_and_name(page)
+        elif hasattr(page, "__name__"):
+            inferred_name = str(page.__name__)
+        elif title is None:
+            # At this point, we know the page is not a string or a path, so it
+            # must be a callable. We expect it to have a __name__ attribute,
+            # but in special cases (e.g. a callable class instance), one may
+            # not exist. In that case, we should inform the user the title is
+            # mandatory.
+            raise StreamlitAPIException(
+                "Cannot infer page title for Callable. Set the `title=` keyword argument."
+            )
+
+        self._page: Path | Callable[[], None] = page
+        self._title: str = title or inferred_name.replace("_", " ")
+
+        if icon is not None:
+            # validate user provided icon.
+            validate_icon_or_emoji(icon)
+        self._icon: str = icon or inferred_icon
+
+        if self._title.strip() == "":
+            raise StreamlitAPIException(
+                "The title of the page cannot be empty or consist of underscores/spaces only"
+            )
+
+        self._url_path: str = inferred_name
+        if url_path is not None:
+            url_path_trimmed = url_path.strip()
+            stripped_url_path = url_path_trimmed.strip("/")
+            if stripped_url_path.strip() == "" and not default:
+                raise StreamlitAPIException(
+                    "The URL path cannot be an empty string unless the page is the default page."
+                )
+
+            self._url_path = stripped_url_path
+            if "/" in self._url_path:
+                raise StreamlitAPIException(
+                    "The URL path cannot contain a nested path (e.g. foo/bar)."
+                )
+
+        if self._icon:
+            validate_icon_or_emoji(self._icon)
+
+        # used by st.navigation to ordain a page as runnable
+        self._can_be_called: bool = False
+
+    @property
+    def title(self) -> str:
+        """The title of the page.
+
+        Unless declared otherwise in ``st.Page``, the page title is inferred
+        from the filename or callable name. For more information, see
+        `Overview of multipage apps
+        <https://docs.streamlit.io/st.page.automatic-page-labels>`_.
+
+        The title supports GitHub-flavored Markdown with restricted elements
+        (bold, italics, strikethroughs, inline code, Material icons, and
+        images).
+        """
+        return self._title
+
+    @property
+    def icon(self) -> str:
+        """The icon of the page.
+
+        If no icon was declared in ``st.Page``, this property returns ``""``.
+        """
+        return self._icon
+
+    @property
+    def url_path(self) -> str:
+        """The page's URL pathname, which is the path relative to the app's \
+        root URL.
+
+        Unless declared otherwise in ``st.Page``, the URL pathname is inferred
+        from the filename or callable name. For more information, see
+        `Overview of multipage apps
+        <https://docs.streamlit.io/st.page.automatic-page-urls>`_.
+
+        The default page will always have a ``url_path`` of ``""`` to indicate
+        the root URL (e.g. homepage).
+        """
+        return "" if self._default else self._url_path
+
+    @property
+    def visibility(self) -> Literal["visible", "hidden"]:
+        """The visibility of the page in the navigation menu.
+
+        This property returns ``"visible"`` (default) or ``"hidden"``.
+        Hidden pages are not shown in the navigation menu but can still
+        be accessed via URL or programmatically using ``st.switch_page``
+        or ``st.page_link``.
+        """
+        return self._visibility
+
+    def run(self) -> None:
+        """Execute the page.
+
+        When a page is returned by ``st.navigation``, use the ``.run()`` method
+        within your entrypoint file to render the page. You can only call this
+        method on the page returned by ``st.navigation``. You can only call
+        this method once per run of your entrypoint file.
+
+        """
+        if not self._can_be_called:
+            raise StreamlitAPIException(
+                "This page cannot be called directly. Only the page returned from st.navigation can be called once."
+            )
+
+        self._can_be_called = False
+
+        ctx = get_script_run_ctx()
+        if not ctx:
+            return
+
+        with ctx.run_with_active_hash(self._script_hash):
+            if callable(self._page):
+                self._page()
+                return
+            code = ctx.pages_manager.get_page_script_byte_code(str(self._page))
+            module = types.ModuleType("__main__")
+            # We want __file__ to be the string path to the script
+            module.__dict__["__file__"] = str(self._page)
+            exec(code, module.__dict__)  # noqa: S102
+
+    @property
+    def _script_hash(self) -> str:
+        return calc_md5(self._url_path)

streamlit/net_util.py

@@ -0,0 +1,125 @@
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2026)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from __future__ import annotations
+
+from typing import Final
+
+from streamlit.logger import get_logger
+
+_LOGGER: Final = get_logger(__name__)
+
+# URLs for checking the current machine's external IP address.
+_AWS_CHECK_IP: Final = "http://checkip.amazonaws.com"
+_AWS_CHECK_IP_HTTPS: Final = "https://checkip.amazonaws.com"
+
+# URL of Streamlit's help page.
+_HELP_DOC: Final = "https://docs.streamlit.io/"
+
+_external_ip: str | None = None
+_internal_ip: str | None = None
+
+
+def get_external_ip() -> str | None:
+    """Get the *external* IP address of the current machine.
+
+    Returns
+    -------
+    string
+        The external IPv4 address of the current machine.
+
+    """
+    global _external_ip  # noqa: PLW0603
+
+    if _external_ip is not None:
+        return _external_ip
+
+    response = _make_blocking_http_get(_AWS_CHECK_IP, timeout=5)
+
+    if response is None:
+        response = _make_blocking_http_get(_AWS_CHECK_IP_HTTPS, timeout=5)
+
+    if _looks_like_an_ip_address(response):
+        _external_ip = response
+    else:
+        _LOGGER.warning(
+            "Did not auto detect external IP.\nPlease go to %s for debugging hints.",
+            _HELP_DOC,
+        )
+        _external_ip = None
+
+    return _external_ip
+
+
+def get_internal_ip() -> str | None:
+    """Get the *local* IP address of the current machine.
+
+    From: https://stackoverflow.com/a/28950776
+
+    Returns
+    -------
+    string
+        The local IPv4 address of the current machine.
+
+    """
+    global _internal_ip  # noqa: PLW0603
+
+    if _internal_ip is not None:
+        return _internal_ip
+
+    import socket
+
+    with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as s:
+        try:
+            # Doesn't even have to be reachable
+            s.connect(("8.8.8.8", 1))
+            _internal_ip = s.getsockname()[0]
+        except Exception:
+            _internal_ip = "127.0.0.1"
+
+    return _internal_ip
+
+
+def _make_blocking_http_get(url: str, timeout: float = 5) -> str | None:
+    import requests
+
+    try:
+        text = requests.get(url, timeout=timeout).text
+        if isinstance(text, str):
+            text = text.strip()
+        return text
+    except Exception:
+        return None
+
+
+def _looks_like_an_ip_address(address: str | None) -> bool:
+    if address is None:
+        return False
+
+    import socket
+
+    try:
+        socket.inet_pton(socket.AF_INET, address)
+        return True  # Yup, this is an IPv4 address!
+    except (AttributeError, OSError):
+        pass
+
+    try:
+        socket.inet_pton(socket.AF_INET6, address)
+        return True  # Yup, this is an IPv6 address!
+    except (AttributeError, OSError):
+        pass
+
+    # Nope, this is not an IP address.
+    return False

streamlit/path_security.py

@@ -0,0 +1,98 @@
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2026)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Shared path security utilities for preventing path traversal and SSRF attacks.
+
+This module provides a centralized implementation for path validation that is
+used by multiple parts of the codebase. Having a single implementation ensures
+consistent security checks and avoids divergent behavior between components.
+
+Security Context
+----------------
+These checks are designed to run BEFORE any filesystem operations (like
+``os.path.realpath()``) to prevent Windows from triggering SMB connections
+to attacker-controlled servers when resolving UNC paths. This prevents
+SSRF attacks and NTLM hash disclosure.
+"""
+
+from __future__ import annotations
+
+import os
+import string
+
+
+def is_unsafe_path_pattern(path: str) -> bool:
+    r"""Return True if path contains UNC, absolute, drive, or traversal patterns.
+
+    This function checks for dangerous path patterns that could lead to:
+    - SSRF attacks via Windows UNC path resolution
+    - NTLM hash disclosure via SMB connections
+    - Path traversal outside intended directories
+    - Path truncation via null bytes
+
+    IMPORTANT: This check must run BEFORE any ``os.path.realpath()`` calls
+    to prevent Windows from triggering SMB connections to attacker-controlled
+    servers.
+
+    Parameters
+    ----------
+    path : str
+        The path string to validate.
+
+    Returns
+    -------
+    bool
+        True if the path contains unsafe patterns, False if it appears safe
+        for further processing.
+
+    Examples
+    --------
+    >>> is_unsafe_path_pattern("subdir/file.js")
+    False
+    >>> is_unsafe_path_pattern("\\\\server\\share")
+    True
+    >>> is_unsafe_path_pattern("../../../etc/passwd")
+    True
+    >>> is_unsafe_path_pattern("C:\\Windows\\system32")
+    True
+    """
+    # Null bytes can be used for path truncation attacks
+    if "\x00" in path:
+        return True
+
+    # UNC paths (Windows network shares, including \\?\ and \\.\ prefixes)
+    if path.startswith(("\\\\", "//")):
+        return True
+
+    # Windows drive paths (e.g. C:\, D:foo) - on Windows, os.path.realpath() on a
+    # drive path can trigger SMB connections if the drive is mapped to a network share.
+    # This enables SSRF attacks and NTLM hash disclosure. We reject all drive-qualified
+    # paths including drive-relative paths like "C:foo" which resolve against the current
+    # directory of that drive. Checked on all platforms for defense-in-depth and
+    # testability (CI runs on Linux).
+    if len(path) >= 2 and path[0] in string.ascii_letters and path[1] == ":":
+        return True
+
+    # Rooted backslash or forward slash (absolute paths)
+    if path.startswith(("\\", "/")):
+        return True
+
+    # Also check os.path.isabs for platform-specific absolute path detection
+    if os.path.isabs(path):
+        return True
+
+    # Path traversal - check segments after normalizing separators
+    normalized = path.replace("\\", "/")
+    segments = [seg for seg in normalized.split("/") if seg]
+    return ".." in segments

streamlit/platform.py

@@ -0,0 +1,31 @@
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2026)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Platform module."""
+
+from __future__ import annotations
+
+from streamlit.proto.ForwardMsg_pb2 import ForwardMsg
+from streamlit.runtime.scriptrunner_utils.script_run_context import get_script_run_ctx
+
+
+def post_parent_message(message: str) -> None:
+    """Sends a string message to the parent window (when host configuration allows)."""
+    ctx = get_script_run_ctx()
+    if ctx is None:
+        return
+
+    fwd_msg = ForwardMsg()
+    fwd_msg.parent_message.message = message
+    ctx.enqueue(fwd_msg)

streamlit/proto/Alert_pb2.py

@@ -0,0 +1,28 @@
+# -*- coding: utf-8 -*-
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: streamlit/proto/Alert.proto
+"""Generated protocol buffer code."""
+from google.protobuf.internal import builder as _builder
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import descriptor_pool as _descriptor_pool
+from google.protobuf import symbol_database as _symbol_database
+# @@protoc_insertion_point(imports)
+
+_sym_db = _symbol_database.Default()
+
+
+from streamlit.proto import WidthConfig_pb2 as streamlit_dot_proto_dot_WidthConfig__pb2
+
+
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1bstreamlit/proto/Alert.proto\x1a!streamlit/proto/WidthConfig.proto\"\xb5\x01\n\x05\x41lert\x12\x0c\n\x04\x62ody\x18\x01 \x01(\t\x12\x1d\n\x06\x66ormat\x18\x02 \x01(\x0e\x32\r.Alert.Format\x12\x0c\n\x04icon\x18\x03 \x01(\t\x12,\n\x0cwidth_config\x18\x04 \x01(\x0b\x32\x16.streamlit.WidthConfig\"C\n\x06\x46ormat\x12\n\n\x06UNUSED\x10\x00\x12\t\n\x05\x45RROR\x10\x01\x12\x0b\n\x07WARNING\x10\x02\x12\x08\n\x04INFO\x10\x03\x12\x0b\n\x07SUCCESS\x10\x04\x62\x06proto3')
+
+_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, globals())
+_builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'streamlit.proto.Alert_pb2', globals())
+if _descriptor._USE_C_DESCRIPTORS == False:
+
+  DESCRIPTOR._options = None
+  _ALERT._serialized_start=67
+  _ALERT._serialized_end=248
+  _ALERT_FORMAT._serialized_start=181
+  _ALERT_FORMAT._serialized_end=248
+# @@protoc_insertion_point(module_scope)