codekingpro/portable-devtools

1"""Init validators for deserialization security.2 3This module contains extra validators that are called during deserialization,4ex. to prevent security issues such as SSRF attacks.5 6Each validator is a callable matching the `InitValidator` protocol: it takes a7class path tuple and kwargs dict, returns `None` on success, and raises8`ValueError` if the deserialization should be blocked.9"""10 11from typing import TYPE_CHECKING, Any12 13if TYPE_CHECKING:14    from langchain_core.load.load import InitValidator15 16 17def _bedrock_validator(class_path: tuple[str, ...], kwargs: dict[str, Any]) -> None:18    """Constructor kwargs validator for AWS Bedrock integrations.19 20    Blocks deserialization if `endpoint_url` or `base_url` parameters are21    present, which could enable SSRF attacks.22 23    Args:24        class_path: The class path tuple being deserialized.25        kwargs: The kwargs dict for the class constructor.26 27    Raises:28        ValueError: If `endpoint_url` or `base_url` parameters are present.29    """30    dangerous_params = ["endpoint_url", "base_url"]31    found_params = [p for p in dangerous_params if p in kwargs]32 33    if found_params:34        class_name = class_path[-1] if class_path else "Unknown"35        param_str = ", ".join(found_params)36        msg = (37            f"Deserialization of {class_name} with {param_str} is not allowed "38            f"for security reasons. These parameters can enable Server-Side Request "39            f"Forgery (SSRF) attacks by directing network requests to arbitrary "40            f"endpoints during initialization. If you need to use a custom endpoint, "41            f"instantiate {class_name} directly rather than deserializing it."42        )43        raise ValueError(msg)44 45 46# Keys must cover both serialized IDs (SERIALIZABLE_MAPPING keys) and resolved47# import paths (SERIALIZABLE_MAPPING values) to prevent bypass via direct paths.48CLASS_INIT_VALIDATORS: dict[tuple[str, ...], "InitValidator"] = {49    # Serialized (legacy) keys50    ("langchain", "chat_models", "bedrock", "BedrockChat"): _bedrock_validator,51    ("langchain", "chat_models", "bedrock", "ChatBedrock"): _bedrock_validator,52    (53        "langchain",54        "chat_models",55        "anthropic_bedrock",56        "ChatAnthropicBedrock",57    ): _bedrock_validator,58    ("langchain_aws", "chat_models", "ChatBedrockConverse"): _bedrock_validator,59    ("langchain", "llms", "bedrock", "Bedrock"): _bedrock_validator,60    ("langchain", "llms", "bedrock", "BedrockLLM"): _bedrock_validator,61    # Resolved import paths (from ALL_SERIALIZABLE_MAPPINGS values) to defend62    # against payloads that use the target tuple directly as the "id".63    (64        "langchain_aws",65        "chat_models",66        "bedrock_converse",67        "ChatBedrockConverse",68    ): _bedrock_validator,69    (70        "langchain_aws",71        "chat_models",72        "anthropic",73        "ChatAnthropicBedrock",74    ): _bedrock_validator,75    ("langchain_aws", "chat_models", "ChatBedrock"): _bedrock_validator,76    ("langchain_aws", "llms", "bedrock", "BedrockLLM"): _bedrock_validator,77}78