o
    h1                     @   s`   d Z ddlZddlmZmZ ddlmZ ddlmZ e	e
ZG dd deZG dd	 d	ZdS )
z3DNS rebinding protection for MCP server transports.    N)	BaseModelField)Request)Responsec                   @   sV   e Zd ZU dZedddZeed< eg ddZe	e
 ed< eg ddZe	e
 ed	< d
S )TransportSecuritySettingszSettings for MCP transport security features.

    These settings help protect against DNS rebinding attacks by validating
    incoming request headers.
    Tz<Enable DNS rebinding protection (recommended for production))defaultdescriptionenable_dns_rebinding_protectionz^List of allowed Host header values. Only applies when enable_dns_rebinding_protection is True.allowed_hostsz`List of allowed Origin header values. Only applies when enable_dns_rebinding_protection is True.allowed_originsN)__name__
__module____qualname____doc__r   r	   bool__annotations__r
   liststrr    r   r   ^/var/www/html/openai_agents/venv/lib/python3.10/site-packages/mcp/server/transport_security.pyr      s   
 r   c                   @   s   e Zd ZdZddedB fddZdedB defdd	Zd
edB defddZ	dedB defddZ
ddedededB fddZdS )TransportSecurityMiddlewarezKMiddleware to enforce DNS rebinding protection for MCP transport endpoints.Nsettingsc                 C   s   |pt dd| _d S )NF)r	   )r   r   )selfr   r   r   r   __init__(   s   z$TransportSecurityMiddleware.__init__hostreturnc                 C   sn   |s	t d dS || jjv rdS | jjD ]}|dr,|dd }||d r, dS qt d|  dS )	z0Validate the Host header against allowed values.zMissing Host header in requestFT:*N:zInvalid Host header: )loggerwarningr   r
   endswith
startswith)r   r   allowed	base_hostr   r   r   _validate_host-   s   

z*TransportSecurityMiddleware._validate_hostoriginc                 C   sd   |sdS || j jv rdS | j jD ]}|dr'|dd }||d r' dS qtd|  dS )z2Validate the Origin header against allowed values.Tr   Nr   r   zInvalid Origin header: F)r   r   r!   r"   r   r    )r   r&   r#   base_originr   r   r   _validate_originC   s   
z,TransportSecurityMiddleware._validate_origincontent_typec                 C   s8   |s	t d dS | dst d|  dS dS )z3Validate the Content-Type header for POST requests.z+Missing Content-Type header in POST requestFzapplication/jsonzInvalid Content-Type header: T)r   r    lowerr"   )r   r)   r   r   r   _validate_content_typeY   s   
z2TransportSecurityMiddleware._validate_content_typeFrequestis_postc                    s|   |r|j d}| |stdddS | jjsdS |j d}| |s+tdddS |j d	}| |s<td
ddS dS )zValidate request headers for DNS rebinding protection.

        Returns None if validation passes, or an error Response if validation fails.
        zcontent-typezInvalid Content-Type headeri  )status_codeNr   zInvalid Host headeri  r&   zInvalid Origin headeri  )headersgetr+   r   r   r	   r%   r(   )r   r,   r-   r)   r   r&   r   r   r   validate_requestf   s   


z,TransportSecurityMiddleware.validate_request)N)F)r   r   r   r   r   r   r   r   r%   r(   r+   r   r   r1   r   r   r   r   r   %   s     r   )r   loggingpydanticr   r   starlette.requestsr   starlette.responsesr   	getLoggerr   r   r   r   r   r   r   r   <module>   s    
