utils.py 4.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142
  1. import typing as t
  2. from .._internal import _encode_idna
  3. from ..exceptions import SecurityError
  4. from ..urls import uri_to_iri
  5. from ..urls import url_quote
  6. def host_is_trusted(hostname: str, trusted_list: t.Iterable[str]) -> bool:
  7. """Check if a host matches a list of trusted names.
  8. :param hostname: The name to check.
  9. :param trusted_list: A list of valid names to match. If a name
  10. starts with a dot it will match all subdomains.
  11. .. versionadded:: 0.9
  12. """
  13. if not hostname:
  14. return False
  15. if isinstance(trusted_list, str):
  16. trusted_list = [trusted_list]
  17. def _normalize(hostname: str) -> bytes:
  18. if ":" in hostname:
  19. hostname = hostname.rsplit(":", 1)[0]
  20. return _encode_idna(hostname)
  21. try:
  22. hostname_bytes = _normalize(hostname)
  23. except UnicodeError:
  24. return False
  25. for ref in trusted_list:
  26. if ref.startswith("."):
  27. ref = ref[1:]
  28. suffix_match = True
  29. else:
  30. suffix_match = False
  31. try:
  32. ref_bytes = _normalize(ref)
  33. except UnicodeError:
  34. return False
  35. if ref_bytes == hostname_bytes:
  36. return True
  37. if suffix_match and hostname_bytes.endswith(b"." + ref_bytes):
  38. return True
  39. return False
  40. def get_host(
  41. scheme: str,
  42. host_header: t.Optional[str],
  43. server: t.Optional[t.Tuple[str, t.Optional[int]]] = None,
  44. trusted_hosts: t.Optional[t.Iterable[str]] = None,
  45. ) -> str:
  46. """Return the host for the given parameters.
  47. This first checks the ``host_header``. If it's not present, then
  48. ``server`` is used. The host will only contain the port if it is
  49. different than the standard port for the protocol.
  50. Optionally, verify that the host is trusted using
  51. :func:`host_is_trusted` and raise a
  52. :exc:`~werkzeug.exceptions.SecurityError` if it is not.
  53. :param scheme: The protocol the request used, like ``"https"``.
  54. :param host_header: The ``Host`` header value.
  55. :param server: Address of the server. ``(host, port)``, or
  56. ``(path, None)`` for unix sockets.
  57. :param trusted_hosts: A list of trusted host names.
  58. :return: Host, with port if necessary.
  59. :raise ~werkzeug.exceptions.SecurityError: If the host is not
  60. trusted.
  61. """
  62. host = ""
  63. if host_header is not None:
  64. host = host_header
  65. elif server is not None:
  66. host = server[0]
  67. if server[1] is not None:
  68. host = f"{host}:{server[1]}"
  69. if scheme in {"http", "ws"} and host.endswith(":80"):
  70. host = host[:-3]
  71. elif scheme in {"https", "wss"} and host.endswith(":443"):
  72. host = host[:-4]
  73. if trusted_hosts is not None:
  74. if not host_is_trusted(host, trusted_hosts):
  75. raise SecurityError(f"Host {host!r} is not trusted.")
  76. return host
  77. def get_current_url(
  78. scheme: str,
  79. host: str,
  80. root_path: t.Optional[str] = None,
  81. path: t.Optional[str] = None,
  82. query_string: t.Optional[bytes] = None,
  83. ) -> str:
  84. """Recreate the URL for a request. If an optional part isn't
  85. provided, it and subsequent parts are not included in the URL.
  86. The URL is an IRI, not a URI, so it may contain Unicode characters.
  87. Use :func:`~werkzeug.urls.iri_to_uri` to convert it to ASCII.
  88. :param scheme: The protocol the request used, like ``"https"``.
  89. :param host: The host the request was made to. See :func:`get_host`.
  90. :param root_path: Prefix that the application is mounted under. This
  91. is prepended to ``path``.
  92. :param path: The path part of the URL after ``root_path``.
  93. :param query_string: The portion of the URL after the "?".
  94. """
  95. url = [scheme, "://", host]
  96. if root_path is None:
  97. url.append("/")
  98. return uri_to_iri("".join(url))
  99. url.append(url_quote(root_path.rstrip("/")))
  100. url.append("/")
  101. if path is None:
  102. return uri_to_iri("".join(url))
  103. url.append(url_quote(path.lstrip("/")))
  104. if query_string:
  105. url.append("?")
  106. url.append(url_quote(query_string, safe=":&%=+$!*'(),"))
  107. return uri_to_iri("".join(url))