o
    ¾­§iJ  ã                   @   s`   d Z ddlZddlmZmZ ddlmZ ddlmZ e 	e
¡ZG dd„ deƒZG dd	„ d	ƒZdS )
z3DNS rebinding protection for MCP server transports.é    N)Ú	BaseModelÚField)ÚRequest)ÚResponsec                   @   sV   e Zd ZU dZedddZeed< eg ddZe	e
 ed< eg ddZe	e
 ed	< d
S )ÚTransportSecuritySettingszSettings for MCP transport security features.

    These settings help protect against DNS rebinding attacks by validating
    incoming request headers.
    Tz<Enable DNS rebinding protection (recommended for production))ÚdefaultÚdescriptionÚenable_dns_rebinding_protectionz^List of allowed Host header values. Only applies when enable_dns_rebinding_protection is True.Úallowed_hostsz`List of allowed Origin header values. Only applies when enable_dns_rebinding_protection is True.Úallowed_originsN)Ú__name__Ú
__module__Ú__qualname__Ú__doc__r   r	   ÚboolÚ__annotations__r
   ÚlistÚstrr   © r   r   úT/home/app/Keep/.python/lib/python3.10/site-packages/mcp/server/transport_security.pyr      s   
 þþþr   c                   @   s‚   e Zd ZdZddedB fdd„ZdedB defdd	„Zd
edB defdd„Z	dedB defdd„Z
ddedededB fdd„ZdS )ÚTransportSecurityMiddlewarezKMiddleware to enforce DNS rebinding protection for MCP transport endpoints.NÚsettingsc                 C   s   |pt dd| _d S )NF)r	   )r   r   )Úselfr   r   r   r   Ú__init__(   s   z$TransportSecurityMiddleware.__init__ÚhostÚreturnc                 C   sn   |s	t  d¡ dS || jjv rdS | jjD ]}| d¡r,|dd… }| |d ¡r, dS qt  d|› ¡ dS )	z0Validate the Host header against allowed values.zMissing Host header in requestFTú:*Néþÿÿÿú:zInvalid Host header: )ÚloggerÚwarningr   r
   ÚendswithÚ
startswith)r   r   ÚallowedZ	base_hostr   r   r   Ú_validate_host-   s   

€z*TransportSecurityMiddleware._validate_hostÚoriginc                 C   sd   |sdS || j jv rdS | j jD ]}| d¡r'|dd… }| |d ¡r' dS qt d|› ¡ dS )z2Validate the Origin header against allowed values.Tr   Nr   r   zInvalid Origin header: F)r   r   r!   r"   r   r    )r   r%   r#   Zbase_originr   r   r   Ú_validate_originC   s   
€z,TransportSecurityMiddleware._validate_originÚcontent_typec                 C   s8   |s	t  d¡ dS | ¡  d¡st  d|› ¡ dS dS )z3Validate the Content-Type header for POST requests.z+Missing Content-Type header in POST requestFzapplication/jsonzInvalid Content-Type header: T)r   r    Úlowerr"   )r   r'   r   r   r   Ú_validate_content_typeY   s   
z2TransportSecurityMiddleware._validate_content_typeFÚrequestÚis_postc                 Ã   s|   |r|j  d¡}|  |¡stdddS | jjsdS |j  d¡}|  |¡s+tdddS |j  d	¡}|  |¡s<td
ddS dS )z•Validate request headers for DNS rebinding protection.

        Returns None if validation passes, or an error Response if validation fails.
        zcontent-typezInvalid Content-Type headeri  )Ústatus_codeNr   zInvalid Host headeri¥  r%   zInvalid Origin headeri“  )ÚheadersÚgetr)   r   r   r	   r$   r&   )r   r*   r+   r'   r   r%   r   r   r   Úvalidate_requestf   s   €


z,TransportSecurityMiddleware.validate_request)N)F)r   r   r   r   r   r   r   r   r$   r&   r)   r   r   r/   r   r   r   r   r   %   s     r   )r   ÚloggingZpydanticr   r   Zstarlette.requestsr   Zstarlette.responsesr   Ú	getLoggerr   r   r   r   r   r   r   r   Ú<module>   s    
