
    )`iJ                         d Z ddlZddlmZmZ ddlmZ ddlmZ  ej	        e
          Z G d de          Z G d d	          ZdS )
z3DNS rebinding protection for MCP server transports.    N)	BaseModelField)Request)Responsec                       e Zd ZU dZ edd          Zeed<    eg d          Ze	e
         ed<    eg d          Ze	e
         ed	<   d
S )TransportSecuritySettingszSettings for MCP transport security features.

    These settings help protect against DNS rebinding attacks by validating
    incoming request headers.
    Tz<Enable DNS rebinding protection (recommended for production))defaultdescriptionenable_dns_rebinding_protectionz^List of allowed Host header values. Only applies when enable_dns_rebinding_protection is True.allowed_hostsz`List of allowed Origin header values. Only applies when enable_dns_rebinding_protection is True.allowed_originsN)__name__
__module____qualname____doc__r   r   bool__annotations__r   liststrr        q/home/jaya/work/projects/VOICE-AGENT/VIET/agent-env/lib/python3.11/site-packages/mcp/server/transport_security.pyr   r      s           -2ER- - -#T   
  %u5     M49    "'5" " "OT#Y     r   r   c                       e Zd ZdZddedz  fdZdedz  defdZdedz  defd	Z	d
edz  defdZ
ddedededz  fdZdS )TransportSecurityMiddlewarezKMiddleware to enforce DNS rebinding protection for MCP transport endpoints.Nsettingsc                 4    |pt          d          | _        d S )NF)r   )r   r   )selfr   s     r   __init__z$TransportSecurityMiddleware.__init__(   s!     !d$=^c$d$d$dr   hostreturnc                 .   |st                               d           dS || j        j        v rdS | j        j        D ]<}|                    d          r%|dd         }|                    |dz             r dS =t                               d|            dS )	z0Validate the Host header against allowed values.zMissing Host header in requestFT:*N:zInvalid Host header: )loggerwarningr   r   endswith
startswith)r   r   allowed	base_hosts       r   _validate_hostz*TransportSecurityMiddleware._validate_host-   s     	NN;<<<5 4=...4 }2 	  	 G%%  #CRCL	??9s?33  445t55666ur   originc                     |sdS || j         j        v rdS | j         j        D ]<}|                    d          r%|dd         }|                    |dz             r dS =t                              d|            dS )z2Validate the Origin header against allowed values.Tr"   Nr#   r$   zInvalid Origin header: F)r   r   r'   r(   r%   r&   )r   r,   r)   base_origins       r   _validate_originz,TransportSecurityMiddleware._validate_originC   s      	4 T]2224 }4 	  	 G%%  %crcl$$[3%677  44999:::ur   content_typec                     |st                               d           dS |                                                    d          st                               d|            dS dS )z3Validate the Content-Type header for POST requests.z+Missing Content-Type header in POST requestFzapplication/jsonzInvalid Content-Type header: T)r%   r&   lowerr(   )r   r0   s     r   _validate_content_typez2TransportSecurityMiddleware._validate_content_typeY   sl     	NNHIII5 !!##../ABB 	NNI<IIJJJ5tr   Frequestis_postc                   K   |r@|j                             d          }|                     |          st          dd          S | j        j        sdS |j                             d          }|                     |          st          dd          S |j                             d	          }|                     |          st          d
d          S dS )zValidate request headers for DNS rebinding protection.

        Returns None if validation passes, or an error Response if validation fails.
        zcontent-typezInvalid Content-Type headeri  )status_codeNr   zInvalid Host headeri  r,   zInvalid Origin headeri  )headersgetr3   r   r   r   r+   r/   )r   r4   r5   r0   r   r,   s         r   validate_requestz,TransportSecurityMiddleware.validate_requestf   s        	P"?..~>>L..|<< P =3OOOO }< 	4 ""6**""4(( 	D1sCCCC $$X..$$V,, 	F3EEEEtr   )N)F)r   r   r   r   r   r   r   r   r+   r/   r3   r   r   r:   r   r   r   r   r   %   s        UUe e!:T!A e e e e
3: $    ,sTz d    ,3: $     g  QY\`Q`      r   r   )r   loggingpydanticr   r   starlette.requestsr   starlette.responsesr   	getLoggerr   r%   r   r   r   r   r   <module>r@      s    9 9  % % % % % % % % & & & & & & ( ( ( ( ( (		8	$	$    	   2Z Z Z Z Z Z Z Z Z Zr   