streamlit 1.45.1__py3-none-any.whl → 1.46.1__py3-none-any.whl

streamlit/web/bootstrap.py

@@ -21,7 +21,6 @@ import sys
 from typing import Any, Final
 
 from streamlit import cli_util, config, env_util, file_util, net_util, secrets
-from streamlit.config import CONFIG_FILENAMES
 from streamlit.git_util import MIN_GIT_VERSION, GitRepo
 from streamlit.logger import get_logger
 from streamlit.watcher import report_watchdog_availability, watch_file
@@ -39,7 +38,7 @@ MAX_APP_STATIC_FOLDER_SIZE = 1 * 1024 * 1024 * 1024  # 1 GB
 def _set_up_signal_handler(server: Server) -> None:
     _LOGGER.debug("Setting up signal handler")
 
-    def signal_handler(signal_number, stack_frame):
+    def signal_handler(signal_number: int, stack_frame: Any) -> None:  # noqa: ARG001
         # The server will shut down its threads and exit its loop.
         server.stop()
 
@@ -98,7 +97,7 @@ def _fix_sys_argv(main_script_path: str, args: list[str]) -> None:
     """
     import sys
 
-    sys.argv = [main_script_path] + list(args)
+    sys.argv = [main_script_path, *list(args)]
 
 
 def _on_server_start(server: Server) -> None:
@@ -112,10 +111,10 @@ def _on_server_start(server: Server) -> None:
     # errors and display them here.
     try:
         secrets.load_if_toml_exists()
-    except Exception as ex:
-        _LOGGER.error("Failed to load secrets.toml file", exc_info=ex)
+    except Exception:
+        _LOGGER.exception("Failed to load secrets.toml file")
 
-    def maybe_open_browser():
+    def maybe_open_browser() -> None:
         if config.get_option("server.headless"):
             # Don't open browser when in headless mode.
             return
@@ -141,7 +140,8 @@ def _fix_pydeck_mapbox_api_warning() -> None:
     will throw an exception.
     """
 
-    os.environ["MAPBOX_API_KEY"] = config.get_option("mapbox.token")
+    if "MAPBOX_API_KEY" not in os.environ:
+        os.environ["MAPBOX_API_KEY"] = config.get_option("mapbox.token")
 
 
 def _maybe_print_static_folder_warning(main_script_path: str) -> None:
@@ -209,7 +209,7 @@ def _print_url(is_running_hello: bool) -> None:
                 named_urls.append(("External URL", server_util.get_url(external_ip)))
 
     cli_util.print_to_cli("")
-    cli_util.print_to_cli("  %s" % title_message, fg="blue", bold=True)
+    cli_util.print_to_cli(f"  {title_message}", fg="blue", bold=True)
     cli_util.print_to_cli("")
 
     for url_name, url in named_urls:
@@ -287,10 +287,10 @@ def load_config_options(flag_options: dict[str, Any]) -> None:
 
 
 def _install_config_watchers(flag_options: dict[str, Any]) -> None:
-    def on_config_changed(_path):
+    def on_config_changed(_path: str) -> None:
         load_config_options(flag_options)
 
-    for filename in CONFIG_FILENAMES:
+    for filename in config.get_config_files("config.toml"):
         if os.path.exists(filename):
             watch_file(filename, on_config_changed)
 
@@ -307,6 +307,7 @@ def run(
 
     This starts a blocking asyncio eventloop.
     """
+
     _fix_sys_path(main_script_path)
     _fix_tornado_crash()
     _fix_sys_argv(main_script_path, args)
@@ -335,18 +336,19 @@ def run(
         await server.stopped
 
     # Run the server. This function will not return until the server is shut down.
-    # FIX RuntimeError: asyncio.run() cannot be called from a running event loop on Python 3.10.16
-    # asyncio.run(run_server())
+    # FIX RuntimeError: asyncio.run() cannot be called from a running event loop
+    # asyncio.run(run_server())  # noqa: ERA001
 
     # Define a main function to handle the event loop logic
-    async def main():
+    async def main() -> None:
         await run_server()
 
     try:
         # Check if we're already in an event loop
         if asyncio.get_running_loop().is_running():
             # Use `asyncio.create_task` if we're in an async context
-            asyncio.create_task(main())
+            # TODO(lukasmasuch): Do we have to store a reference for the task here?
+            asyncio.create_task(main())  # noqa: RUF006
         else:
             # Otherwise, use `asyncio.run`
             asyncio.run(main())

streamlit/web/cli.py

@@ -18,15 +18,15 @@ from __future__ import annotations
 
 import os
 import sys
-from typing import TYPE_CHECKING, Any, Callable, TypeVar
+from typing import TYPE_CHECKING, Any, Callable, Final, TypeVar
 
 # We cannot lazy-load click here because its used via decorators.
 import click
 
-import streamlit.runtime.caching as caching
-import streamlit.web.bootstrap as bootstrap
 from streamlit import config as _config
+from streamlit.runtime import caching
 from streamlit.runtime.credentials import Credentials, check_credentials
+from streamlit.web import bootstrap
 from streamlit.web.cache_storage_manager_config import (
     create_default_cache_storage_manager,
 )
@@ -34,9 +34,9 @@ from streamlit.web.cache_storage_manager_config import (
 if TYPE_CHECKING:
     from streamlit.config_option import ConfigOption
 
-ACCEPTED_FILE_EXTENSIONS = ("py", "py3")
+ACCEPTED_FILE_EXTENSIONS: Final = ("py", "py3")
 
-LOG_LEVELS = ("error", "warning", "info", "debug")
+LOG_LEVELS: Final = ("error", "warning", "info", "debug")
 
 
 def _convert_config_option_to_click_option(
@@ -63,10 +63,12 @@ def _convert_config_option_to_click_option(
     }
 
 
-def _make_sensitive_option_callback(config_option: ConfigOption):
-    def callback(_ctx: click.Context, _param: click.Parameter, cli_value) -> None:
+def _make_sensitive_option_callback(
+    config_option: ConfigOption,
+) -> Callable[[click.Context, click.Parameter, Any], None]:
+    def callback(_ctx: click.Context, _param: click.Parameter, cli_value: Any) -> None:
         if cli_value is None:
-            return None
+            return
         raise SystemExit(
             f"Setting {config_option.key!r} option using the CLI flag is not allowed. "
             f"Set this option in the configuration file or environment "
@@ -103,7 +105,7 @@ def configurator_options(func: F) -> F:
             help=parsed_parameter["description"],
             type=parsed_parameter["type"],
             multiple=parsed_parameter["multiple"],
-            **click_option_kwargs,
+            **click_option_kwargs,  # type: ignore
         )
         func = config_option(func)
     return func
@@ -115,7 +117,7 @@ def _download_remote(main_script_path: str, url_path: str) -> None:
 
     with open(main_script_path, "wb") as fp:
         try:
-            resp = requests.get(url_path)
+            resp = requests.get(url_path, timeout=30)
             resp.raise_for_status()
             fp.write(resp.content)
         except requests.exceptions.RequestException as e:
@@ -125,7 +127,7 @@ def _download_remote(main_script_path: str, url_path: str) -> None:
 @click.group(context_settings={"auto_envvar_prefix": "STREAMLIT"})
 @click.option("--log_level", show_default=True, type=click.Choice(LOG_LEVELS))
 @click.version_option(prog_name="Streamlit")
-def main(log_level="info"):
+def main(log_level: str = "info") -> None:
     """Try out a demo with:
 
         $ streamlit hello
@@ -138,29 +140,27 @@ def main(log_level="info"):
     if log_level:
         from streamlit.logger import get_logger
 
-        LOGGER = get_logger(__name__)
-        LOGGER.warning(
+        logger: Final = get_logger(__name__)
+        logger.warning(
             "Setting the log level using the --log_level flag is unsupported."
             "\nUse the --logger.level flag (after your streamlit command) instead."
         )
 
 
 @main.command("help")
-def help():
+def help() -> None:  # noqa: A001
     """Print this help message."""
     # We use _get_command_line_as_string to run some error checks but don't do
     # anything with its return value.
     _get_command_line_as_string()
 
-    assert len(sys.argv) == 2  # This is always true, but let's assert anyway.
-
     # Pretend user typed 'streamlit --help' instead of 'streamlit help'.
     sys.argv[1] = "--help"
     main(prog_name="streamlit")
 
 
 @main.command("version")
-def main_version():
+def main_version() -> None:
     """Print Streamlit's version number."""
     # Pretend user typed 'streamlit --version' instead of 'streamlit version'
     import sys
@@ -169,13 +169,12 @@ def main_version():
     # anything with its return value.
     _get_command_line_as_string()
 
-    assert len(sys.argv) == 2  # This is always true, but let's assert anyway.
     sys.argv[1] = "--version"
     main()
 
 
 @main.command("docs")
-def main_docs():
+def main_docs() -> None:
     """Show help in browser."""
     click.echo("Showing help page in browser...")
     from streamlit import cli_util
@@ -185,11 +184,10 @@ def main_docs():
 
 @main.command("hello")
 @configurator_options
-def main_hello(**kwargs):
+def main_hello(**kwargs: Any) -> None:
     """Runs the Hello World script."""
     from streamlit.hello import streamlit_app
 
-    bootstrap.load_config_options(flag_options=kwargs)
     filename = streamlit_app.__file__
     _main_run(filename, flag_options=kwargs)
 
@@ -198,7 +196,7 @@ def main_hello(**kwargs):
 @configurator_options
 @click.argument("target", required=True, envvar="STREAMLIT_RUN_TARGET")
 @click.argument("args", nargs=-1)
-def main_run(target: str, args=None, **kwargs):
+def main_run(target: str, args: list[str] | None = None, **kwargs: Any) -> None:
     """Run a Python script, piping stderr to Streamlit.
 
     The script can be local or it can be an url. In the latter case, Streamlit
@@ -207,18 +205,16 @@ def main_run(target: str, args=None, **kwargs):
     """
     from streamlit import url_util
 
-    bootstrap.load_config_options(flag_options=kwargs)
-
     _, extension = os.path.splitext(target)
     if extension[1:] not in ACCEPTED_FILE_EXTENSIONS:
         if extension[1:] == "":
             raise click.BadArgumentUsage(
-                "Streamlit requires raw Python (.py) files, but the provided file has no extension.\nFor more information, please see https://docs.streamlit.io"
-            )
-        else:
-            raise click.BadArgumentUsage(
-                f"Streamlit requires raw Python (.py) files, not {extension}.\nFor more information, please see https://docs.streamlit.io"
+                "Streamlit requires raw Python (.py) files, but the provided file has no extension.\n"
+                "For more information, please see https://docs.streamlit.io"
             )
+        raise click.BadArgumentUsage(
+            f"Streamlit requires raw Python (.py) files, not {extension}.\nFor more information, please see https://docs.streamlit.io"
+        )
 
     if url_util.is_url(target):
         from streamlit.temporary_directory import TemporaryDirectory
@@ -259,10 +255,16 @@ def _get_command_line_as_string() -> str | None:
 
 
 def _main_run(
-    file,
+    file: str,
     args: list[str] | None = None,
     flag_options: dict[str, Any] | None = None,
 ) -> None:
+    # Set the main script path to use it for config & secret files
+    # While its a bit suboptimal, we need to store this into a module-level
+    # variable before we load the config options via `load_config_options`
+    _config._main_script_path = os.path.abspath(file)
+
+    bootstrap.load_config_options(flag_options=flag_options or {})
     if args is None:
         args = []
 
@@ -276,17 +278,17 @@ def _main_run(
     bootstrap.run(file, is_hello, args, flag_options)
 
 
-# SUBCOMMAND: cache
+# SUBCOMMAND cache
 
 
 @main.group("cache")
-def cache():
+def cache() -> None:
     """Manage the Streamlit cache."""
     pass
 
 
 @cache.command("clear")
-def cache_clear():
+def cache_clear() -> None:
     """Clear st.cache_data and st.cache_resource caches."""
 
     # in this `streamlit cache clear` cli command we cannot use the
@@ -299,18 +301,18 @@ def cache_clear():
     caching.cache_resource.clear()
 
 
-# SUBCOMMAND: config
+# SUBCOMMAND config
 
 
 @main.group("config")
-def config():
+def config() -> None:
     """Manage Streamlit's config settings."""
     pass
 
 
 @config.command("show")
 @configurator_options
-def config_show(**kwargs):
+def config_show(**kwargs: Any) -> None:
     """Show all of Streamlit's config settings."""
 
     bootstrap.load_config_options(flag_options=kwargs)
@@ -318,28 +320,28 @@ def config_show(**kwargs):
     _config.show_config()
 
 
-# SUBCOMMAND: activate
+# SUBCOMMAND activate
 
 
 @main.group("activate", invoke_without_command=True)
 @click.pass_context
-def activate(ctx):
+def activate(ctx: click.Context) -> None:
     """Activate Streamlit by entering your email."""
     if not ctx.invoked_subcommand:
         Credentials.get_current().activate()
 
 
 @activate.command("reset")
-def activate_reset():
+def activate_reset() -> None:
     """Reset Activation Credentials."""
     Credentials.get_current().reset()
 
 
-# SUBCOMMAND: test
+# SUBCOMMAND test
 
 
 @main.group("test", hidden=True)
-def test():
+def test() -> None:
     """Internal-only commands used for testing.
 
     These commands are not included in the output of `streamlit help`.
@@ -348,7 +350,7 @@ def test():
 
 
 @test.command("prog_name")
-def test_prog_name():
+def test_prog_name() -> None:
     """Assert that the program name is set to `streamlit test`.
 
     This is used by our cli-smoke-tests to verify that the program name is set
@@ -361,13 +363,18 @@ def test_prog_name():
 
     parent = click.get_current_context().parent
 
-    assert parent is not None
-    assert parent.command_path == "streamlit test"
+    if parent is None:
+        raise AssertionError("parent is None")
+
+    if parent.command_path != "streamlit test":
+        raise AssertionError(
+            f"Parent command path is {parent.command_path} not streamlit test."
+        )
 
 
 @main.command("init")
 @click.argument("directory", required=False)
-def main_init(directory: str | None = None):
+def main_init(directory: str | None = None) -> None:
     """Initialize a new Streamlit project.
 
     If DIRECTORY is specified, create it and initialize the project there.

streamlit/web/server/__init__.py

@@ -13,14 +13,18 @@
 # limitations under the License.
 
 from streamlit.web.server.component_request_handler import ComponentRequestHandler
-from streamlit.web.server.routes import allow_cross_origin_requests
+from streamlit.web.server.routes import (
+    allow_all_cross_origin_requests,
+    is_allowed_origin,
+)
 from streamlit.web.server.server import Server, server_address_is_unix_socket
 from streamlit.web.server.stats_request_handler import StatsRequestHandler
 
 __all__ = [
     "ComponentRequestHandler",
-    "allow_cross_origin_requests",
     "Server",
-    "server_address_is_unix_socket",
     "StatsRequestHandler",
+    "allow_all_cross_origin_requests",
+    "is_allowed_origin",
+    "server_address_is_unix_socket",
 ]

streamlit/web/server/app_static_file_handler.py

@@ -82,7 +82,7 @@ class AppStaticFileHandler(tornado.web.StaticFileHandler):
 
         return ret_val
 
-    def set_default_headers(self):
+    def set_default_headers(self) -> None:
         # CORS protection is disabled because we need access to this endpoint
         # from the inner iframe.
         self.set_header("Access-Control-Allow-Origin", "*")

streamlit/web/server/authlib_tornado_integration.py

@@ -16,7 +16,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING, Any
 
-from authlib.integrations.base_client import (  # type: ignore[import-untyped]
+from authlib.integrations.base_client import (
     FrameworkIntegration,
 )
 
@@ -28,15 +28,20 @@ if TYPE_CHECKING:
     from streamlit.web.server.oidc_mixin import TornadoOAuth
 
 
-class TornadoIntegration(FrameworkIntegration):  # type: ignore[misc]
-    def update_token(self, token, refresh_token=None, access_token=None):
+class TornadoIntegration(FrameworkIntegration):
+    def update_token(
+        self,
+        token: dict[str, Any],
+        refresh_token: dict[str, Any] | None = None,
+        access_token: dict[str, Any] | None = None,
+    ) -> None:
         """We do not support access token refresh, since we obtain and operate only on
         identity tokens. We override this method explicitly to implement all abstract
         methods of base class.
         """
 
     @staticmethod
-    def load_config(
+    def load_config(  # type: ignore[override]
         oauth: TornadoOAuth, name: str, params: Sequence[str]
     ) -> dict[str, Any]:
         """Configure Authlib integration with provider parameters

streamlit/web/server/browser_websocket_handler.py

@@ -113,6 +113,12 @@ class BrowserWebSocketHandler(WebSocketHandler, SessionClient):
             del cookie_value["is_logged_in"]
             user_info.update(cookie_value)
 
+        else:
+            _LOGGER.error(
+                "Origin mismatch, the origin of websocket request is not the "
+                "same origin of redirect_uri in secrets.toml",
+            )
+
         return user_info
 
     def write_forward_msg(self, msg: ForwardMsg) -> None:
@@ -148,7 +154,7 @@ class BrowserWebSocketHandler(WebSocketHandler, SessionClient):
 
         return None
 
-    def open(self, *args, **kwargs) -> Awaitable[None] | None:
+    def open(self, *args: Any, **kwargs: Any) -> Awaitable[None] | None:
         user_info: dict[str, str | bool | None] = {}
 
         existing_session_id = None
@@ -207,7 +213,7 @@ class BrowserWebSocketHandler(WebSocketHandler, SessionClient):
             if isinstance(payload, str):
                 # Sanity check. (The frontend should only be sending us bytes;
                 # Protobuf.ParseFromString does not accept str input.)
-                raise RuntimeError(
+                raise TypeError(  # noqa: TRY301
                     "WebSocket received an unexpected `str` message. "
                     "(We expect `bytes` only.)"
                 )

streamlit/web/server/component_request_handler.py

@@ -16,7 +16,7 @@ from __future__ import annotations
 
 import mimetypes
 import os
-from typing import TYPE_CHECKING, Final
+from typing import TYPE_CHECKING, Final, cast
 
 import tornado.web
 
@@ -30,7 +30,7 @@ _LOGGER: Final = get_logger(__name__)
 
 
 class ComponentRequestHandler(tornado.web.RequestHandler):
-    def initialize(self, registry: BaseComponentRegistry):
+    def initialize(self, registry: BaseComponentRegistry) -> None:
         self._registry = registry
 
     def get(self, path: str) -> None:
@@ -55,9 +55,10 @@ class ComponentRequestHandler(tornado.web.RequestHandler):
         try:
             with open(abspath, "rb") as file:
                 contents = file.read()
-        except OSError as e:
-            _LOGGER.error(
-                "ComponentRequestHandler: GET %s read error", abspath, exc_info=e
+        except OSError:
+            sanitized_abspath = abspath.replace("\n", "").replace("\r", "")
+            _LOGGER.exception(
+                "ComponentRequestHandler: GET %s read error", sanitized_abspath
             )
             self.write("read error")
             self.set_status(404)
@@ -82,8 +83,12 @@ class ComponentRequestHandler(tornado.web.RequestHandler):
             self.set_header("Cache-Control", "public")
 
     def set_default_headers(self) -> None:
-        if streamlit.web.server.routes.allow_cross_origin_requests():
+        if streamlit.web.server.routes.allow_all_cross_origin_requests():
             self.set_header("Access-Control-Allow-Origin", "*")
+        elif streamlit.web.server.routes.is_allowed_origin(
+            origin := self.request.headers.get("Origin")
+        ):
+            self.set_header("Access-Control-Allow-Origin", cast("str", origin))
 
     def options(self) -> None:
         """/OPTIONS handler for preflight CORS checks."""
@@ -102,13 +107,12 @@ class ComponentRequestHandler(tornado.web.RequestHandler):
         # As of 2015-07-21 there is no bzip2 encoding defined at
         # http://www.iana.org/assignments/media-types/media-types.xhtml
         # So for that (and any other encoding), use octet-stream.
-        elif encoding is not None:
+        if encoding is not None:
             return "application/octet-stream"
-        elif mime_type is not None:
+        if mime_type is not None:
             return mime_type
         # if mime_type not detected, use application/octet-stream
-        else:
-            return "application/octet-stream"
+        return "application/octet-stream"
 
     @staticmethod
     def get_url(file_id: str) -> str:

streamlit/web/server/media_file_handler.py

@@ -14,6 +14,7 @@
 
 from __future__ import annotations
 
+from typing import Any, cast
 from urllib.parse import quote
 
 import tornado.web
@@ -24,7 +25,7 @@ from streamlit.runtime.memory_media_file_storage import (
     MemoryMediaFileStorage,
     get_extension_for_mimetype,
 )
-from streamlit.web.server import allow_cross_origin_requests
+from streamlit.web.server import allow_all_cross_origin_requests, is_allowed_origin
 
 _LOGGER = get_logger(__name__)
 
@@ -43,8 +44,10 @@ class MediaFileHandler(tornado.web.StaticFileHandler):
         cls._storage = storage
 
     def set_default_headers(self) -> None:
-        if allow_cross_origin_requests():
+        if allow_all_cross_origin_requests():
             self.set_header("Access-Control-Allow-Origin", "*")
+        elif is_allowed_origin(origin := self.request.headers.get("Origin")):
+            self.set_header("Access-Control-Allow-Origin", cast("str", origin))
 
     def set_extra_headers(self, path: str) -> None:
         """Add Content-Disposition header for downloadable files.
@@ -83,11 +86,15 @@ class MediaFileHandler(tornado.web.StaticFileHandler):
     # static content from a database), override `get_content`,
     # `get_content_size`, `get_modified_time`, `get_absolute_path`, and
     # `validate_absolute_path`.
-    def validate_absolute_path(self, root: str, absolute_path: str) -> str:
+    def validate_absolute_path(
+        self,
+        root: str,  # noqa: ARG002
+        absolute_path: str,
+    ) -> str:
         try:
             self._storage.get_file(absolute_path)
         except MediaFileStorageError:
-            _LOGGER.error("MediaFileHandler: Missing file %s", absolute_path)
+            _LOGGER.exception("MediaFileHandler: Missing file %s", absolute_path)
             raise tornado.web.HTTPError(404, "not found")
 
         return absolute_path
@@ -106,7 +113,7 @@ class MediaFileHandler(tornado.web.StaticFileHandler):
         return None
 
     @classmethod
-    def get_absolute_path(cls, root: str, path: str) -> str:
+    def get_absolute_path(cls, root: str, path: str) -> str:  # noqa: ARG003
         # All files are stored in memory, so the absolute path is just the
         # path itself. In the MediaFileHandler, it's just the filename
         return path
@@ -114,14 +121,14 @@ class MediaFileHandler(tornado.web.StaticFileHandler):
     @classmethod
     def get_content(
         cls, abspath: str, start: int | None = None, end: int | None = None
-    ):
+    ) -> Any:
         _LOGGER.debug("MediaFileHandler: GET %s", abspath)
 
         try:
             # abspath is the hash as used `get_absolute_path`
             media_file = cls._storage.get_file(abspath)
         except Exception:
-            _LOGGER.error("MediaFileHandler: Missing file %s", abspath)
+            _LOGGER.exception("MediaFileHandler: Missing file %s", abspath)
             return None
 
         _LOGGER.debug(