Ë
    ý{™h1  ã                   ó†   — d Z ddlZddlmZmZ ddlmZ ddlmZ  ej                  e
«      Z G d„ de«      Z G d„ d	«      Zy)
z3DNS rebinding protection for MCP server transports.é    N)Ú	BaseModelÚField)ÚRequest)ÚResponsec                   óx   — e Zd ZU dZ edd¬«      Zeed<    eg d¬«      Ze	e
   ed<    eg d¬«      Ze	e
   ed	<   y
)ÚTransportSecuritySettingszSettings for MCP transport security features.

    These settings help protect against DNS rebinding attacks by validating
    incoming request headers.
    Tz<Enable DNS rebinding protection (recommended for production))ÚdefaultÚdescriptionÚenable_dns_rebinding_protectionz^List of allowed Host header values. Only applies when enable_dns_rebinding_protection is True.Úallowed_hostsz`List of allowed Origin header values. Only applies when enable_dns_rebinding_protection is True.Úallowed_originsN)Ú__name__Ú
__module__Ú__qualname__Ú__doc__r   r   ÚboolÚ__annotations__r   ÚlistÚstrr   © ó    ú^/var/www/html/hubwallet-dev/venv/lib/python3.12/site-packages/mcp/server/transport_security.pyr   r      s_   … ññ -2ØØRô-Ð# Tó ñ
  %Øð5ô €M4˜‘9ó ñ "'Øð5ô"€OT˜#‘Yô r   r   c                   ó‚   — e Zd ZdZddedz  fd„Zdedz  defd„Zdedz  defd	„Z	d
edz  defd„Z
ddedededz  fd„Zy)ÚTransportSecurityMiddlewarezKMiddleware to enforce DNS rebinding protection for MCP transport endpoints.NÚsettingsc                 ó.   — |xs t        d¬«      | _        y )NF)r   )r   r   )Úselfr   s     r   Ú__init__z$TransportSecurityMiddleware.__init__(   s   € ð !ÒdÔ$=Ð^cÔ$dˆr   ÚhostÚreturnc                 ó&  — |st         j                  d«       y|| j                  j                  v ry| j                  j                  D ]/  }|j	                  d«      sŒ|dd }|j                  |dz   «      sŒ/ y t         j                  d|› «       y)	z0Validate the Host header against allowed values.zMissing Host header in requestFTú:*Néþÿÿÿú:zInvalid Host header: )ÚloggerÚwarningr   r   ÚendswithÚ
startswith)r   r   ÚallowedÚ	base_hosts       r   Ú_validate_hostz*TransportSecurityMiddleware._validate_host-   sŒ   € áÜN‰NÐ;Ô<Øð 4—=‘=×.Ñ.Ñ.Øð —}‘}×2Ñ2ò 	 ˆGØ×Ñ Õ%à# C R˜L	à—?‘? 9¨s¡?Õ3Ùð	 ô 	‰Ð.¨t¨fÐ5Ô6Ør   Úoriginc                 óü   — |sy|| j                   j                  v ry| j                   j                  D ]/  }|j                  d«      sŒ|dd }|j                  |dz   «      sŒ/ y t        j                  d|› «       y)z2Validate the Origin header against allowed values.Tr"   Nr#   r$   zInvalid Origin header: F)r   r   r'   r(   r%   r&   )r   r,   r)   Úbase_origins       r   Ú_validate_originz,TransportSecurityMiddleware._validate_originC   s„   € ñ Øð T—]‘]×2Ñ2Ñ2Øð —}‘}×4Ñ4ò 	 ˆGØ×Ñ Õ%à% c r˜là×$Ñ$ [°3Ñ%6Õ7Ùð	 ô 	‰Ð0°°Ð9Ô:Ør   Úcontent_typec                 ó¤   — |st         j                  d«       y|j                  «       j                  d«      st         j                  d|› «       yy)z3Validate the Content-Type header for POST requests.z+Missing Content-Type header in POST requestFzapplication/jsonzInvalid Content-Type header: T)r%   r&   Úlowerr(   )r   r0   s     r   Ú_validate_content_typez2TransportSecurityMiddleware._validate_content_typeY   sI   € áÜN‰NÐHÔIØð ×!Ñ!Ó#×.Ñ.Ð/AÔBÜN‰NÐ:¸<¸.ÐIÔJØàr   ÚrequestÚis_postc              ƒ   ó”  K  — |r9|j                   j                  d«      }| j                  |«      st        dd¬«      S | j                  j
                  sy|j                   j                  d«      }| j                  |«      st        dd¬«      S |j                   j                  d	«      }| j                  |«      st        d
d¬«      S y­w)z•Validate request headers for DNS rebinding protection.

        Returns None if validation passes, or an error Response if validation fails.
        zcontent-typezInvalid Content-Type headeri  )Ústatus_codeNr   zInvalid Host headeri¥  r,   zInvalid Origin header)ÚheadersÚgetr3   r   r   r   r+   r/   )r   r4   r5   r0   r   r,   s         r   Úvalidate_requestz,TransportSecurityMiddleware.validate_requestf   s´   è ø€ ñ Ø"Ÿ?™?×.Ñ.¨~Ó>ˆLØ×.Ñ.¨|Ô<ÜÐ =È3ÔOÐOð }‰}×<Ò<Øð ‰×"Ñ" 6Ó*ˆØ×"Ñ" 4Ô(ÜÐ1¸sÔCÐCð —‘×$Ñ$ XÓ.ˆØ×$Ñ$ VÔ,ÜÐ3ÀÔEÐEàùs   ‚CC)N)F)r   r   r   r   r   r   r   r   r+   r/   r3   r   r   r:   r   r   r   r   r   %   s   „ ÙUñeÐ!:¸TÑ!Aó eð
 3¨¡:ð °$ó ð, s¨T¡zð °dó ð,°3¸±:ð À$ó ñ¨gð Àð ÐQYÐ\`ÑQ`ô r   r   )r   ÚloggingÚpydanticr   r   Ústarlette.requestsr   Ústarlette.responsesr   Ú	getLoggerr   r%   r   r   r   r   r   ú<module>r@      s>   ðÙ 9ã ç %Ý &Ý (à	ˆ×	Ñ	˜8Ó	$€ô 	ô ÷2Zò Zr   