Yash030/claude-code-proxy
2
1+
2 �E j:
� � � R t ^ RIHt ^ RIt^ RIt^ RIHt ^ RIHt ]! RRR7 ! R R4 4 t ! R R3]44 t R R lt R
R lt
R R ltR R ltR# )z>Egress policy for user-controlled web_fetch URLs (SSRF guard).)� annotationsN)� dataclass)�urlparseT)�frozen�slotsc �0 � ] tR t^ t$ RtR]R& R]R& RtR# )�WebFetchEgressPolicyz0Egress rules for user-influenced web_fetch URLs.�bool� allow_private_network_targetszfrozenset[str]�allowed_schemes� N)�__name__�5__module__� __qualname__�__firstlineno__�__doc__�__annotations__�__static_attributes__r � �<C:\Users\yashw\.claude\temp-hf-clone\api\web_tools\egress.pyr r s � �:�#'�'�#�#r r c � � ] tR t^tRtRtR# )�WebFetchEgressViolationzFRaised when a web_fetch URL is rejected by egress policy (SSRF guard).r N)r
r r r r r r r r r r s � �Pr r c � � V ^8� d QhRR/# )� �return�intr )�formats "r � __annotate__r s � � C� C�S� Cr c � � V P e
V P # V P ;' g RP 4 R8X d R# ^P# )N� �httpsi� )�port�scheme�lower)�parseds &r �
_port_for_urlr% s= � �
�{�{� ��{�{���=�=�&�&�B�-�-�/�7�:�3�B��Br c �$ � V ^8� d QhRRRRRR/# )r �host�strr! r r � list[tuple]r )r s "r r r s! � � � �s� �#� �+� r c � � \ P ! W\ P \ P R 7 # \ d p\ RT : RT 24 ThRp?ii ; i))�type�protozCould not resolve host z: N)�socket� getaddrinfo� SOCK_STREAM� IPPROTO_TCP�OSErrorr )r' r! �excs && r � _stream_getaddrinfo_or_raiser3 s_ � ���!�!� �V� /� /�v�7I�7I�6� 7�� � �%�%�d�X�R��u� 5�8�� ���s �47 � A�A�Ac �$ � V ^8� d QhRRRRRR/# )r �urlr( �policyr r r) r )r s "r r r ( s$ � � 6� 6� �6�*�6��6r c �~ � \ V 4 pVP ;' g RP 4 pW1P 9 d \ RV: R24 hVP9 pVe VR8X d \ R4 h\
V4 pVP ' d \ WE4 # VP 4 pVR8X g VP R4 ' d \ R4 hVP R 4 ' d \ R104 h \ P ! V4 pVe. VP ' g \ R V: R24 h\ WE4 # \ WE4 pV FJ Ev r�V11^ , p \ P ! V 4 p T P ' d K9 \ R T: R
T R24 h V# \ d Rp L�i ; i \ d Kq i ; i)a. Resolve and validate a URL for web_fetch, returning getaddrinfo rows for pinning.12 13Each HTTP connect pins to only these `getaddrinfo` results so a malicious DNS14server cannot rebind to a disallowed address between resolution and the TCP15connect (used by :func:`api.web_tools.outbound._run_web_fetch`).16r z URL scheme z is not allowed for web_fetchNz!web_fetch URL must include a host� localhostz17.localhostz/localhost targets are not allowed for web_fetchz.localz..local hostnames are not allowed for web_fetchzNon-public IP host zHost z# resolves to a non-public address (�))r r" r# r r �hostnamer% r18 r3 �endswith� ipaddress�19ip_address�20ValueError� is_global)
r5 r6 r$ r" r' r! �21host_lower� parsed_ip�infos�_�sockaddr�addr�resolveds
&& r �)get_validated_stream_addrinfos_for_egressrG ( s� � � �c�]�F��m�m�!�!�r�
(�
(�
*�F�
�+�+�+�%��&��#@� A�22� 23� �?�?�D� �|�t�r�z�%�&I�J�J� �� �D�
�+�+�+�+�D�7�7���� �J��[� �J�$7�$7� �$E�$E�%�&W�X�X����8�$�$�%�&V�W�W�� �(�(��.� � � ��"�"�"�)�%�d�X�-J�K��
� ,�D�7�7� (�� 4�E� � ����{�� � �+�+�D�1�H� �!�!�!�)���x� B�8�*�A�N��
� � �L��+ � �� ��� � � � �s$ �6F �F-�
F*�)F*�- F<�;F<c �$ � V ^8� d QhRRRRRR/# )r r5 r( r6 r r �Noner )r s "r r r a s" � � ;� ;�#� ;�/C� ;�� ;r c � � \ W4 R# )zFValidate ``url`` (scheme, host, and resolved addresses) for web_fetch.N)rG )r5 r6 s &&r �enforce_web_fetch_egressrK a s24 � �-�c�:r )r �25__future__r r< r- � dataclassesr � urllib.parser r r> r r% r3 rG rK r r r �<module>rO s[ �� D� "� �
� !� !� �$�d�#�$� $� $�$�Q�j� Q�C� �6�r;r