.ighddlmZddlZddlmZmZmZmZGddZd dZ d dZ Gdd Z y) ) annotationsN)ASGI3ApplicationASGIReceiveCallableASGISendCallableScopec"eZdZdZdddZddZy)ProxyHeadersMiddlewareaBMiddleware for handling known proxy headers This middleware can be used when a known proxy is fronting the application, and is trusted to be properly setting the `X-Forwarded-Proto` and `X-Forwarded-For` headers with the connecting client information. Modifies the `client` and `scheme` information so that they reference the connecting client, rather that the connecting proxy. References: - - c2||_t||_yN)app _TrustedHosts trusted_hosts)selfr rs R/root/launch/venv/lib/python3.12/site-packages/uvicorn/middleware/proxy_headers.py__init__zProxyHeadersMiddleware.__init__s*=9cK|ddk(r|j|||d{S|jd}|r|dnd}||jvrt|d}d|vrI|dj dj }|dvr#|dd k(r|j d d |d <n||d <d |vr;|d j d}|jj|\} } | r| | f|d<|j|||d{S77w)Ntypelifespanclientrheaderssx-forwarded-protolatin1>wswsshttphttps websocketrrschemesx-forwarded-for)r getrdictdecodestripreplaceget_trusted_client_address) rscopereceivesend client_addr client_hostrx_forwarded_protox_forwarded_forhostports r__call__zProxyHeadersMiddleware.__call__s' =J &%$77 7ii) (3k!n $,, ,5+,G#w.$+,@$A$H$H$R$X$X$Z!$(FFV} 3*;*C*CFD*Qh*;h!W,")*<"="D"DX"N!//JJ?[ d(,TlE(OXXeWd3337864s"DDCD>D?DDN)z 127.0.0.1)r rrlist[str] | strreturnNone)r%rr&rr'rr0r1)__name__ __module__ __qualname____doc__rr.rrr r s :4rr cf|jdDcgc]}|jc}Scc}w)N,)splitr")valueitems r_parse_raw_hostsr<;s%%*[[%5 6TDJJL 66 6s.c|jdrS|jd}|dk(r|dfS|d|}||dzd}|s|dfS|jds|dfS |t|ddfS|j ddk(r#|j dd\}} |t|fS|dfS#t$r|dfcYSwxYw#t$r|dfcYSwxYw)a&Parse a forwarded host value into host and optional port. Accepts bare IPs, IPv4 `host:port`, and bracketed IPv6 `[host]:port`. Any unrecognized or malformed value is treated conservatively and returned without a port so trust checks do not silently normalize arbitrary input. []rN:) startswithfindint ValueErrorcountrsplit)r: bracket_endr, remainderr-s r_parse_host_portrK?s jjo " !8OQ{#+/+, 7N##C(!8O Yqr]++ + {{31\\#q) d T? " !8O 7N  !8O s$B  B3 B0/B03 CCc(eZdZdZddZddZddZy) r z(Container for trusted hosts and networkscB|ddgfv|_t|_t|_t|_|jst |t r t|}|D]e}d|vr0 |jjtj|7 |jjtj|gyy#t$r|jj|YwxYw#t$r|jj|YwxYw)N*/) always_trustsettrusted_literalsrtrusted_networks isinstancestrr<add ipaddress ip_networkrF ip_address)rrr,s rrz_TrustedHosts.__init__es"/C#<"?*-%QTQVTWTY  -- 0 ? % 8 $;8--11)2F2Ft2LM 8**..y/C/CD/IJ 8 !&8--11$78 &8--11$78s$+.C .C7 $C43C47$DDc|jry|sy tj||jvryt fd|j DS#t $r||jvcYSwxYw)NTFc3&K|]}|v ywr r6).0netips r z-_TrustedHosts.__contains__..sBSrSyBs)rPrWrYranyrSrFrR)rr,r^s @r __contains__z_TrustedHosts.__contains__sr    1%%d+BT'''BD,A,ABB B 14000 0 1s#AAA/.A/ct|}|jrt|dSt|D]}t|\}}||vs||fcSt|dS)zExtract the client address from x_forwarded_for header. In general this is the first "untrusted" host in the forwarded for list. r)r<rPrKreversed)rr+x_forwarded_for_hosts host_portr,r-s rr$z(_TrustedHosts.get_trusted_client_addressss !1 A   #$9!$<= =""78 "I))4JD$4Tz! " 5a 899rN)rr/r0r1)r,z str | Noner0bool)r+rUr0tuple[str, int])r2r3r4r5rrar$r6rrr r bs2%8N1 :rr )r:rUr0z list[str])r:rUr0rg) __future__rrWuvicorn._typesrrrrr r<rKr r6rrrjs3"YY0404f7 FL:L:r