ó
    Cìh1  ã                   ó†   • S r SSKrSSKJrJr  SSKJr  SSKJr  \R                  " \
5      r " S S\5      r " S S	5      rg)
z3DNS rebinding protection for MCP server transports.é    N)Ú	BaseModelÚField)ÚRequest)ÚResponsec                   ón   • \ rS rSr% Sr\" SSS9r\\S'   \" / SS9r	\
\   \S'   \" / S	S9r\
\   \S
'   Srg)ÚTransportSecuritySettingsé   z‘Settings for MCP transport security features.

These settings help protect against DNS rebinding attacks by validating
incoming request headers.
Tz<Enable DNS rebinding protection (recommended for production))ÚdefaultÚdescriptionÚenable_dns_rebinding_protectionz^List of allowed Host header values. Only applies when enable_dns_rebinding_protection is True.Úallowed_hostsz`List of allowed Origin header values. Only applies when enable_dns_rebinding_protection is True.Úallowed_origins© N)Ú__name__Ú
__module__Ú__qualname__Ú__firstlineno__Ú__doc__r   r   ÚboolÚ__annotations__r   ÚlistÚstrr   Ú__static_attributes__r   ó    ÚW/home/james-whalen/.local/lib/python3.13/site-packages/mcp/server/transport_security.pyr   r      s_   ‡ ññ -2ØØRñ-Ð# Tó ñ
  %Øð5ñ €M4˜‘9ó ñ "'Øð5ñ"€OT˜#‘Yö r   r   c                   ó˜   • \ rS rSrSrSS\S-  4S jjrS\S-  S\4S jr	S	\S-  S\4S
 jr
S\S-  S\4S jrSS\S\S\S-  4S jjrSrg)ÚTransportSecurityMiddlewareé%   zKMiddleware to enforce DNS rebinding protection for MCP transport endpoints.NÚsettingsc                 ó2   • U=(       d	    [        SS9U l        g )NF)r   )r   r   )Úselfr   s     r   Ú__init__Ú$TransportSecurityMiddleware.__init__(   s   € ð !×dÔ$=Ð^cÑ$dˆr   ÚhostÚreturnc                 óL  • U(       d  [         R                  S5        gXR                  R                  ;   a  gU R                  R                   H;  nUR	                  S5      (       d  M  USS nUR                  US-   5      (       d  M;    g   [         R                  SU 35        g)	z0Validate the Host header against allowed values.zMissing Host header in requestFTú:*NéþÿÿÿÚ:zInvalid Host header: )ÚloggerÚwarningr   r   ÚendswithÚ
startswith)r!   r$   ÚallowedÚ	base_hosts       r   Ú_validate_hostÚ*TransportSecurityMiddleware._validate_host-   s‹   € æÜN‰NÐ;Ô<Øð —=‘=×.Ñ.Ó.Øð —}‘}×2Ô2ˆGØ×Ñ ×%Ó%à# C R˜L	à—?‘? 9¨s¡?×3Ó3Ùñ 3ô 	‰Ð.¨t¨fÐ5Ô6Ør   Úoriginc                 ó"  • U(       d  gXR                   R                  ;   a  gU R                   R                   H;  nUR                  S5      (       d  M  USS nUR                  US-   5      (       d  M;    g   [        R                  SU 35        g)z2Validate the Origin header against allowed values.Tr'   Nr(   r)   zInvalid Origin header: F)r   r   r,   r-   r*   r+   )r!   r2   r.   Úbase_origins       r   Ú_validate_originÚ,TransportSecurityMiddleware._validate_originC   sƒ   € ö Øð —]‘]×2Ñ2Ó2Øð —}‘}×4Ô4ˆGØ×Ñ ×%Ó%à% c r˜là×$Ñ$ [°3Ñ%6×7Ó7Ùñ 5ô 	‰Ð0°°Ð9Ô:Ør   Úcontent_typec                 ó¸   • U(       d  [         R                  S5        gUR                  5       R                  S5      (       d  [         R                  SU 35        gg)z3Validate the Content-Type header for POST requests.z+Missing Content-Type header in POST requestFzapplication/jsonzInvalid Content-Type header: T)r*   r+   Úlowerr-   )r!   r7   s     r   Ú_validate_content_typeÚ2TransportSecurityMiddleware._validate_content_typeY   sL   € æÜN‰NÐHÔIØð ×!Ñ!Ó#×.Ñ.Ð/A×BÑBÜN‰NÐ:¸<¸.ÐIÔJØàr   ÚrequestÚis_postc              ƒ   ó´  #   • U(       a;  UR                   R                  S5      nU R                  U5      (       d
  [        SSS9$ U R                  R
                  (       d  gUR                   R                  S5      nU R                  U5      (       d
  [        SSS9$ UR                   R                  S	5      nU R                  U5      (       d
  [        S
SS9$ g7f)z…Validate request headers for DNS rebinding protection.

Returns None if validation passes, or an error Response if validation fails.
zcontent-typezInvalid Content-Type headeri  )Ústatus_codeNr$   zInvalid Host headeri¥  r2   zInvalid Origin headeri“  )ÚheadersÚgetr:   r   r   r   r0   r5   )r!   r<   r=   r7   r$   r2   s         r   Úvalidate_requestÚ,TransportSecurityMiddleware.validate_requestf   s¼   é € ö Ø"Ÿ?™?×.Ñ.¨~Ó>ˆLØ×.Ñ.¨|×<Ñ<ÜÐ =È3ÑOÐOð }‰}×<×<Øð ‰×"Ñ" 6Ó*ˆØ×"Ñ" 4×(Ñ(ÜÐ1¸sÑCÐCð —‘×$Ñ$ XÓ.ˆØ×$Ñ$ V×,Ñ,ÜÐ3ÀÑEÐEàùs   ‚CC)r   )N)F)r   r   r   r   r   r   r"   r   r   r0   r5   r:   r   r   rB   r   r   r   r   r   r   %   s„   † ÙUñeÐ!:¸TÑ!Aõ eð
 3¨¡:ð °$ô ð, s¨T¡zð °dô ð,°3¸±:ð À$ô ñ¨gð Àð ÐQYÐ\`ÑQ`÷ ð r   r   )r   ÚloggingÚpydanticr   r   Ústarlette.requestsr   Ústarlette.responsesr   Ú	getLoggerr   r*   r   r   r   r   r   Ú<module>rI      s<   ðÙ 9ã ç %Ý &Ý (à	×	Ò	˜8Ó	$€ô 	ô ÷2Zò Zr   