o
    ;hB                     @   s   d dl mZ d dlZdZdZdZdZdZdd	d
ZdZ	ddddd	ddZ
ddiZi Zi ZdZG dd deZzd dlZdd ZW dS  ey[   d dlZd dlZe Zdd ZY dS w )    )OrderedDictNDENY
SAMEORIGINz
ALLOW-FROMi>zstrict-origin-when-cross-originz'self'z'none')default-src
object-srcZLaxz1'self' themes.googleusercontent.com *.gstatic.comz%'self' www.google.com www.youtube.comzG'self' ajax.googleapis.com *.googleanalytics.com *.google-analytics.comz='self' ajax.googleapis.com fonts.googleapis.com *.gstatic.comz'self' *.gstatic.com)zfont-srcz	frame-srcz
script-srcz	style-srcr   r   zbrowsing-topicsz()    c                   @   s   e Zd ZdZd'ddZeeedddeddde	de
dddeddeddfddZd	d
 Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd  Zd!d" Zd#d$ Zd%d& ZdS )(TalismanzB
    Talisman is a Flask extension for HTTP security headers.
    Nc                 K   s"   |d ur| j |fi | d S d S N)init_app)selfappkwargs r   J/var/www/html/venv/lib/python3.10/site-packages/flask_talisman/talisman.py__init__C   s   zTalisman.__init__TFc                 C   s@  t |trt|| _n|| _t |trt|| _n|| _t |tr't|| _n|| _|| _|| _|| _|	| _	|
| _
|| _|| _|| _t |trMt|| _n|| _|| _|| _| jrb| jdu rbtd|peg | _| j|jjd< || _|| _||jd< |rd|jd< || _|| _|| _|| _|| j || j | | j! dS )a
  
        Initialization.

        Args:
            app: A Flask application.
            feature_policy: A string or dictionary describing the
                feature policy for the response.
            permissions_policy: A string or dictionary describing the
                permissions policy for the response.
            document_policy: A string or dictionary describing the
                document policy for the response.
            force_https: Redirects non-http requests to https, disabled in
                debug mode.
            force_https_permanent: Uses 301 instead of 302 redirects.
            frame_options: Sets the X-Frame-Options header, defaults to
                SAMEORIGIN.
            frame_options_allow_from: Used when frame_options is set to
                ALLOW_FROM and is a string of domains to allow frame embedding.
            strict_transport_security: Sets HSTS headers.
            strict_transport_security_preload: Enables HSTS preload. See
                https://hstspreload.org.
            strict_transport_security_max_age: How long HSTS headers are
                honored by the browser.
            strict_transport_security_include_subdomains: Whether to include
                all subdomains when setting HSTS.
            content_security_policy: A string or dictionary describing the
                content security policy for the response.
            content_security_policy_report_uri: A string indicating the report
                URI used for CSP violation reports
            content_security_policy_report_only: Whether to set the CSP header
                as "report-only", which disables the enforcement by the browser
                and requires a "report-uri" parameter with a backend to receive
                the POST data
            content_security_policy_nonce_in: A list of csp sections to include
                a per-request nonce value in
            referrer_policy: A string describing the referrer policy for the
                response.
            session_cookie_secure: Forces the session cookie to only be sent
                over https. Disabled in debug mode.
            session_cookie_http_only: Prevents JavaScript from reading the
                session cookie.
            session_cookie_samesite: Sets samesite parameter on session cookie
            force_file_save: Prevents the user from opening a file download
                directly on >= IE 8
            x_content_type_options: Prevents MIME type sniffing
            x_xss_protection: Prevents the page from loading when the browser
                detects reflected cross-site scripting attacks

        See README.rst for a detailed description of each option.
        Nz}Setting content_security_policy_report_only to True also requires a URI to be specified in content_security_policy_report_uri	csp_nonceZSESSION_COOKIE_SAMESITETZSESSION_COOKIE_HTTPONLY)"
isinstancedictr   feature_policypermissions_policydocument_policyforce_httpsforce_https_permanentframe_optionsframe_options_allow_fromstrict_transport_security!strict_transport_security_preload!strict_transport_security_max_age,strict_transport_security_include_subdomainscontent_security_policy"content_security_policy_report_uri#content_security_policy_report_only
ValueError content_security_policy_nonce_in
_get_nonceZ	jinja_envglobalsreferrer_policysession_cookie_secureconfigforce_file_savex_content_type_optionsx_xss_protectionr   Zbefore_request_force_https_make_nonceZafter_request_set_response_headers)r   r   r   r   r   r   r   r)   r   r   r   r   r   r   r   r    r!   r#   r&   r'   Zsession_cookie_http_onlyZsession_cookie_samesiter*   r+   r   r   r   r
   G   s^   
K





zTalisman.init_appc                 C   s   t jjt jj}t|di }|d| j |d| j	 |d| j
 |d| j |d| j |d| j |d| j |d	| j |S )
Ntalisman_view_optionsr   r   r   r   r#   r   r   r   )flaskZcurrent_appZview_functionsgetrequestZendpointgetattr
setdefaultr   r   r   r   r#   r   r   r   )r   Zview_functionZview_optionsr   r   r   _get_local_options   s8   zTalisman._get_local_optionsc                 C   s   | j r| jjsd| jjd< | jjtjjtjjdddkg}| 	 }|d rJt
|sLtjjdrNtjjddd	}d
}| jrAd}tj||d}|S dS dS dS )zZRedirect any non-https requests to https.

        Based largely on flask-sslify.
        TZSESSION_COOKIE_SECUREX-Forwarded-Protohttphttpsr   zhttp://zhttps://   i.  i-  )codeN)r'   r   debugr(   r0   r2   	is_secureheadersr1   r5   anyurl
startswithreplacer   redirect)r   criterialocal_optionsr?   r:   rr   r   r   r,      s$   zTalisman._force_httpsc                 C   sj   |   }| |j| | |j| | |j| | |j| | |j| | |j | |j |S )z5Applies all configured headers to the given response.)	r5   _set_feature_policy_headersr=   _set_permissions_policy_headers_set_document_policy_headers_set_frame_options_headers$_set_content_security_policy_headers_set_hsts_headers_set_referrer_policy_headers)r   responseoptionsr   r   r   r.     s   zTalisman._set_response_headersc                 C   sB   |   }|d r|d rttjdd stttj_d S d S d S d S )Nr   r#   r   )r5   r3   r0   r2   get_random_stringNONCE_LENGTHr   )r   rD   r   r   r   r-     s   zTalisman._make_noncec                 C   s   t tjddS )Nr    )r3   r0   r2   )r   r   r   r   r$         zTalisman._get_noncec                 C   sH   t |tr|S g }| D ]\}}d||}|| qd|}|S )Nz{}={}z, )r   stritemsformatappendjoin)r   policypoliciessectioncontentpolicy_partr   r   r   _parse_structured_header_policy#  s   

z(Talisman._parse_structured_header_policyc           	      C   s   |   }t|tr*|}t }|dD ]}| d}d|dd  ||d < qg }| D ].\}}t|ts>d|}d||}t	t
jdrY||d v rY|dt
jj7 }|| q0d	|}|S )
N; r9   r   z{} {}r   r#   z 'nonce-{}'z; )r5   r   rS   r   splitstriprW   rT   rU   hasattrr0   r2   r   rV   )	r   rX   rD   Zpolicy_stringr\   Zpolicy_partsrY   rZ   r[   r   r   r   _parse_policy1  s&   




zTalisman._parse_policyc                 C   *   |d sd S |d }|  |}||d< d S )Nr   zFeature-Policy)rc   r   r=   rN   rX   r   r   r   rF   M  
   
z$Talisman._set_feature_policy_headersc                 C   rd   )Nr   zPermissions-Policyr]   re   r   r   r   rG   V  rf   z(Talisman._set_permissions_policy_headersc                 C   rd   )Nr   zDocument-Policyrg   re   r   r   r   rH   _  rf   z%Talisman._set_document_policy_headersc                 C   sF   |d sd S |d |d< |d t kr!|d  d|d 7  < d S d S )Nr   zX-Frame-Optionsz {}r   )
ALLOW_FROMrU   )r   r=   rN   r   r   r   rI   h  s   z#Talisman._set_frame_options_headersc                 C   s   | j rd|d< | jrd|d< | jrd|d< |d sd S |d }| |}| jr2d|vr2|d	| j 7 }d
}| jr;|d7 }|||< d S )Nz1; mode=blockzX-XSS-ProtectionZnosniffzX-Content-Type-OptionsZnoopenzX-Download-Optionsr   z
report-uriz; report-uri zContent-Security-Policyz-Report-Only)r+   r*   r)   rc   r    r!   )r   r=   rN   rX   Z
csp_headerr   r   r   rJ   q  s"   
z-Talisman._set_content_security_policy_headersc                 C   sb   t jjt jjdddkg}| jrt|sd S d| j}| j	r$|d7 }| j
r+|d7 }||d< d S )Nr6   r7   r8   z
max-age={}z; includeSubDomainsz	; preloadzStrict-Transport-Security)r0   r2   r<   r=   r1   r   r>   rU   r   r   r   )r   r=   rC   valuer   r   r   rK     s   zTalisman._set_hsts_headersc                 C   s   | j |d< d S )NzReferrer-Policy)r&   )r   r=   r   r   r   rL     rR   z%Talisman._set_referrer_policy_headersc                    s    fdd}|S )a  Use talisman as a decorator to configure options for a particular
        view.

        Only force_https, frame_options, frame_options_allow_from,
        content_security_policy, content_security_policy_nonce_in
        and feature_policy can be set on a per-view basis.

        Example:

            app = Flask(__name__)
            talisman = Talisman(app)

            @app.route('/normal')
            def normal():
                return 'Normal'

            @app.route('/embeddable')
            @talisman(frame_options=ALLOW_FROM, frame_options_allow_from='*')
            def embeddable():
                return 'Embeddable'
        c                    s   t | d  | S )Nr/   )setattr)fr   r   r   	decorator  s   z$Talisman.__call__.<locals>.decoratorr   )r   r   rm   r   rl   r   __call__  s   zTalisman.__call__r	   )__name__
__module____qualname____doc__r   DEFAULT_FEATURE_POLICYDEFAULT_PERMISSIONS_POLICYDEFAULT_DOCUMENT_POLICYr   ONE_YEAR_IN_SECSDEFAULT_CSP_POLICYDEFAULT_REFERRER_POLICYDEFAULT_SESSION_COOKIE_SAMESITEr
   r5   r,   r.   r-   r$   r]   rc   rF   rG   rH   rI   rJ   rK   rL   rn   r   r   r   r   r   >   sT    

 				r   c                 C   s   t | d |  S r	   )secretsZtoken_urlsafelengthr   r   r   rO     s   rO   c                    s.   t jt j t j  d fddt| D S )NrQ   c                 3   s    | ]}t  V  qd S r	   )rndchoice).0_allowed_charsr   r   	<genexpr>  s
    
z$get_random_string.<locals>.<genexpr>)stringascii_lowercaseascii_uppercasedigitsrW   ranger{   r   r   r   rO     s   )collectionsr   r0   r   r   rh   rv   rx   rw   ry   ZGOOGLE_CSP_POLICYrt   ru   rs   rP   objectr   rz   rO   ImportErrorrandomr   SystemRandomr}   r   r   r   r   <module>   sH      