o
    2h*                     @   s   d Z ddlZddlmZ ddlmZ ddlmZ ddlm	Z	 e	
 ZdZdZd	d
gdd
gdgd
gdZejddG dd dZdd ZG dd dZdS )z0Validates responses and their security features.    N)
Collection)Headers)http)
tb_loggingz	text/htmlzdefault-srcz'unsafe-inline'zdata:zblob:z'unsafe-eval')z	style-srczimg-srcz
script-srczfont-srcT)frozenc                   @   s&   e Zd ZU dZeed< ee ed< dS )	DirectivezContent security policy directive.

    Loosely follow vocabulary from https://www.w3.org/TR/CSP/#framework-directives.

    Attributes:
      name: A non-empty string.
      value: A collection of non-empty strings.
    namevalueN)__name__
__module____qualname____doc__str__annotations__r    r   r   a/var/www/html/chatgem/venv/lib/python3.10/site-packages/tensorboard/backend/security_validator.pyr   ,   s   
 	r   c                 C   s   t d|   d S )Nz-In 3.0, this warning will become an error:
%s)loggerwarning)	error_msgr   r   r   _maybe_raise_value_error;   s   r   c                   @   sP   e Zd ZdZdd Zdd Zdd Zdd	 Zd
d Zdd Z	dd Z
dd ZdS )SecurityValidatorMiddlewarea  WSGI middleware validating security on response.

    It validates:
    - responses have Content-Type
    - responses have X-Content-Type-Options: nosniff
    - text/html responses have CSP header. It also validates whether the CSP
      headers pass basic requirement. e.g., default-src should be present, cannot
      use "*" directive, and others. For more complete list, please refer to
      _validate_csp_policies.

    Instances of this class are WSGI applications (see PEP 3333).
    c                 C   s
   || _ dS )zInitializes an `SecurityValidatorMiddleware`.

        Args:
          application: The WSGI application to wrap (see PEP 3333).
        N_application)selfapplicationr   r   r   __init__N   s   
z$SecurityValidatorMiddleware.__init__c                    s   d fdd	}  ||S )Nc                    s     | | ||S N)_validate_headers)statusheadersexc_infor   start_responser   r   start_response_proxyW   s   
zBSecurityValidatorMiddleware.__call__.<locals>.start_response_proxyr   r   )r   environr"   r#   r   r!   r   __call__V   s   z$SecurityValidatorMiddleware.__call__c                 C   s*   t |}| | | | | | d S r   )r   _validate_content_type _validate_x_content_type_options_validate_csp_headers)r   headers_listr   r   r   r   r   ]   s   

z-SecurityValidatorMiddleware._validate_headersc                 C   s   | drd S td d S )NContent-Typez&Content-Type is required on a Responsegetr   )r   r   r   r   r   r&   c   s   
z2SecurityValidatorMiddleware._validate_content_typec                 C   s"   | d}|dkrd S td d S )NzX-Content-Type-Optionsnosniffz2X-Content-Type-Options is required to be "nosniff"r+   )r   r   optionr   r   r   r'   i   s   
z<SecurityValidatorMiddleware._validate_x_content_type_optionsc                 C   sT   t |d\}}|tkrd S |d}g }|D ]	}|| |7 }q| | d S )Nr*   zContent-Security-Policy)r   parse_options_headerr,   _HTML_MIME_TYPEget_all_parse_serialized_csp_validate_csp_policies)r   r   	mime_type_	csp_textspoliciescsp_textr   r   r   r(   r   s   
z1SecurityValidatorMiddleware._validate_csp_headersc                 C   s   d}g }|D ]9}|j }|jD ]0}|p|tk}|t|g v rq|dks1|dks1|ds1|dr2qdj||d}|| qq|sG|d |rRtd		| d S d S )
NFz'self'z'none'zhttps:z'sha256-z3Illegal Content-Security-Policy for {name}: {value}r   r	   z0Requires default-src for Content-Security-Policy
)
r   r	   _CSP_DEFAULT_SRC_CSP_IGNOREr,   
startswithformatappendr   join)r   r7   has_default_src
violations	directiver   r	   msgr   r   r   r3      s6   
z2SecurityValidatorMiddleware._validate_csp_policiesc           
      C   s|   | d}g }|D ]2}| }|sq	| d d}|d }t|dkr&|d nd}| }|  }t||d}	||	 q	|S )N;   r       r9   )splitstriplenlowerr   r?   )
r   r8   csp_srcspolicytoken
token_fragr   valuesr	   rC   r   r   r   r2      s   
z1SecurityValidatorMiddleware._parse_serialized_cspN)r
   r   r   r   r   r%   r   r&   r'   r(   r3   r2   r   r   r   r   r   @   s    	*r   )r   dataclassestypingr   werkzeug.datastructuresr   werkzeugr   tensorboard.utilr   
get_loggerr   r0   r;   r<   	dataclassr   r   r   r   r   r   r   <module>   s$   
