
    &Vf*                         d Z ddlZddlmZ ddlmZ ddlmZ ddlm	Z	  e	j
                    ZdZdZd	d
gdd
gdgd
gdZ ej        d           G d d                      Zd Z G d d          ZdS )z0Validates responses and their security features.    N)
Collection)Headers)http)
tb_loggingz	text/htmlzdefault-srcz'unsafe-inline'zdata:zblob:z'unsafe-eval')z	style-srczimg-srcz
script-srczfont-srcT)frozenc                   4    e Zd ZU dZeed<   ee         ed<   dS )	DirectivezContent security policy directive.

    Loosely follow vocabulary from https://www.w3.org/TR/CSP/#framework-directives.

    Attributes:
      name: A non-empty string.
      value: A collection of non-empty strings.
    namevalueN)__name__
__module____qualname____doc__str__annotations__r        c/var/www/html/software/conda/lib/python3.11/site-packages/tensorboard/backend/security_validator.pyr	   r	   ,   s7           IIIc?r   r	   c                 @    t                               d| z             d S )Nz-In 3.0, this warning will become an error:
%s)loggerwarning)	error_msgs    r   _maybe_raise_value_errorr   ;   s     
NNCiOPPPPPr   c                   B    e Zd ZdZd Zd Zd Zd Zd Zd Z	d Z
d	 Zd
S )SecurityValidatorMiddlewarea  WSGI middleware validating security on response.

    It validates:
    - responses have Content-Type
    - responses have X-Content-Type-Options: nosniff
    - text/html responses have CSP header. It also validates whether the CSP
      headers pass basic requirement. e.g., default-src should be present, cannot
      use "*" directive, and others. For more complete list, please refer to
      _validate_csp_policies.

    Instances of this class are WSGI applications (see PEP 3333).
    c                     || _         dS )zInitializes an `SecurityValidatorMiddleware`.

        Args:
          application: The WSGI application to wrap (see PEP 3333).
        N_application)selfapplications     r   __init__z$SecurityValidatorMiddleware.__init__N   s     (r   c                 @     d fd	}                      ||          S )Nc                 H                         |            | ||          S N)_validate_headers)statusheadersexc_infor   start_responses      r   start_response_proxyzBSecurityValidatorMiddleware.__call__.<locals>.start_response_proxyW   s+    ""7+++!>&'8<<<r   r$   r   )r   environr)   r*   s   ` ` r   __call__z$SecurityValidatorMiddleware.__call__V   s@    	= 	= 	= 	= 	= 	= 	=   *>???r   c                     t          |          }|                     |           |                     |           |                     |           d S r$   )r   _validate_content_type _validate_x_content_type_options_validate_csp_headers)r   headers_listr'   s      r   r%   z-SecurityValidatorMiddleware._validate_headers]   sQ    ,''##G,,,--g666""7+++++r   c                 R    |                     d          rd S t          d           d S )NContent-Typez&Content-Type is required on a Responsegetr   )r   r'   s     r   r.   z2SecurityValidatorMiddleware._validate_content_typec   s0    ;;~&& 	F !IJJJJJr   c                 ^    |                     d          }|dk    rd S t          d           d S )NzX-Content-Type-Optionsnosniffz2X-Content-Type-Options is required to be "nosniff"r4   )r   r'   options      r   r/   z<SecurityValidatorMiddleware._validate_x_content_type_optionsi   sC    566YF @	
 	
 	
 	
 	
r   c                    t          j        |                    d                    \  }}|t          k    rd S |                    d          }g }|D ]}||                     |          z  }|                     |           d S )Nr3   zContent-Security-Policy)r   parse_options_headerr5   _HTML_MIME_TYPEget_all_parse_serialized_csp_validate_csp_policies)r   r'   	mime_type_	csp_textspoliciescsp_texts          r   r0   z1SecurityValidatorMiddleware._validate_csp_headersr   s    0^1L1LMM	1''FOO$=>>	! 	= 	=H228<<<HH##H-----r   c                    d}g }|D ]}|j         }|j        D ]}|p
|t          k    }|t                              |g           v r-|dk    s0|dk    s*|                    d          s|                    d          rdd                    ||          }|                    |           |s|                    d           |r$t          d		                    |                     d S d S )
NFz'self'z'none'zhttps:z'sha256-z3Illegal Content-Security-Policy for {name}: {value}r
   r   z0Requires default-src for Content-Security-Policy
)
r
   r   _CSP_DEFAULT_SRC_CSP_IGNOREr5   
startswithformatappendr   join)r   rB   has_default_src
violations	directiver
   r   msgs           r   r>   z2SecurityValidatorMiddleware._validate_csp_policies   s?   
! 	' 	'I>D" ' '"1"MT=M5MKOOD"5555 X%%((''11 )''
33 ) KRRU S   !!#&&&&5'8  	B    	<$TYYz%:%:;;;;;	< 	<r   c                 ~   |                     d          }g }|D ]}|                                }|s|                     d d          }|d         }t          |          dk    r|d         nd}|                                }|                                 }t	          ||          }	|                    |	           |S )N;   r       rE   )splitstriplenlowerr	   rK   )
r   rC   csp_srcspolicytoken
token_fragr
   valuesr   rO   s
             r   r=   z1SecurityValidatorMiddleware._parse_serialized_csp   s     >>#&& 	% 	%EKKMME  T1--Ja=D&)*oo&:&:Z]]F ::<<D LLNNE!t5999IMM)$$$$r   N)r   r   r   r   r!   r,   r%   r.   r/   r0   r>   r=   r   r   r   r   r   @   s         ( ( (@ @ @, , ,K K K
 
 
. . .(< (< (<T" " " " "r   r   )r   dataclassestypingr   werkzeug.datastructuresr   werkzeugr   tensorboard.utilr   
get_loggerr   r;   rG   rH   	dataclassr	   r   r   r   r   r   <module>rf      s<   7 6           + + + + + +       ' ' ' ' ' '			 	    $W-! ##		 	 d###       $#Q Q Q
K K K K K K K K K Kr   