
    Mi'                     <   S r  SSKrSSKrSSKrSSKrSSKrSSKrSSKrSSK	r	SSK
Jr  SSKJr  SSKJrJr  SrSqSqS rSS jr SS	 jr\" S
S9S 5       rSS jr " S S\R2                  R4                  5      rS rSS jr " S S\	R<                  5      r/ SQrg)z+Centralized I/O security sentinel for NLTK.    N)	lru_cache)Path)unquoteurlparseFc                  `   / n S[         R                  ;   a'  [        [        [         R                  S   S/ 5      5      n [        R
                  R                  SS5      nX4n[        b  [        U:X  a  [        $ [        5       nXR                  [        R                  5      -    H]  nU(       d  M   [        US5      (       a  UR                  OUnUR                  [        [!        U5      5      R#                  5       5        M_     SSKnSSUR-                  5       4 HS  n [        U5      R/                  5       R#                  5       nUR1                  5       (       a  UR                  U5        MS  MU     UqUqU$ ! [$        [&        [(        4 a     M  f = f! [$        [&        [(        4 a     M  f = f)	zDDynamically determines allowed directories based on NLTK data paths.z	nltk.datapath	NLTK_DATA Nr   z~/nltk_dataz/usr/share/nltk_data)sysmoduleslistgetattrosenvironget_ALLOWED_ROOTS_CACHE_LAST_DATA_PATHSsetsplitpathsephasattrr   addr   strresolveOSError
ValueErrorRuntimeErrortempfile
gettempdir
expanduserexists)current_paths	env_pathscurrent_staterootspraw_pr   locs           f/var/www/eduai.edurigo.com/storigo/production/storigo_env/lib/python3.13/site-packages/nltk/pathsec.py_get_allowed_rootsr*      se    Mckk!WS[[%=vrJK

{B/I".M',<,M##EE__RZZ881")!V"4"4!		$s5z*2245 9 5x7J7J7LM	S	$$&..0Axxzz		!  N !$L Z6  \2 		s&   0AE8AF8FFF-,F-c                   ^^ [        U [        5      (       d%  U (       a  [        U 5      R                  5       (       d  g [	        U S5      (       a  U R
                  O
[        U 5      nSU;   aA  [        U5      nUR                  S;   a  gUR                  S:X  a  [        UR
                  5      n [        U5      R                  5       mU(       aq  [	        US5      (       a  UR
                  O
[        U5      n[        U5      R                  5       nTU:X  d*  TR                  U5      (       d  [        SU S	T S
U 35      e[!        5       n	[#        U4S jU	 5       5      (       a  g [        [$        R&                  " 5       5      R                  5       mTT:X  d  TR                  T5      (       aY  [#        U4S jU	 5       5      (       a  gSU S3n
[(        (       a  [+        U
5      e[,        R.                  " SU S	T S3[0        SS9  g SU ST 3n
[(        (       a  [+        U
5      e[,        R.                  " U
[0        SS9  g! [        [        4 aX    UR                  5       nSU;   a3  UR                  S5      S-   n[        USU 5      R                  5       m GN[        U5      m GNf = f! [        [        4 a     Nf = f! [*        [        4 a    e [2         a    [(        (       a  e  gf = f)a/  
Ensures file access is restricted to allowed data directories.

:param path_input: The path to validate.
:param context: Diagnostic context for warnings/errors.
:param required_root: If provided, enforces that the path is strictly
                      within this specific directory (scoped sandbox).
Nr   z://)httphttpsftpfilez.zip   Security Violation [z]: Path z escapes root c              3   ^   >#    U  H"  nTU:H  =(       d    TR                  U5      v   M$     g 7fN)is_relative_to).0roottargets     r)   	<genexpr> validate_path.<locals>.<genexpr>x   s(     Wv~<!6!6t!<<s   *-c              3   .   >#    U  H
  nTU:H  v   M     g 7fr3    )r5   r6   cwds     r)   r8   r9      s     =}tsd{}s   zS]: CWD access restricted in ENFORCE mode. Authorize via: nltk.data.path.append('.')zSecurity Warning [z allowed via CWD.   
stacklevelz]: Unauthorized path )
isinstanceintr   stripr   r   r   schemer   r   r   r   r   lowerfindr4   r*   anyr   getcwdENFORCEPermissionErrorwarningswarnRuntimeWarning	Exception)
path_inputcontextrequired_rootrawparsed	lower_rawzip_idxroot_rawscoped_rootallowed_rootsmsgr<   r7   s              @@r)   validate_pathrY   F   s    *c""*C
O<Q<Q<S<SI!(V!<!<joo#j/C<c]F}} 88}}&fkk*		##Y&&(F  =&11 ""' 
 x.002Kk)V-B-B;-O-O *7)8F8>R]Q^_ 
 +,WWWW	ryy{#++-C} 5 5c : :=}===*7) 4@ @  7)#..MM,WIXfXEVW&#$
  !;& %WI-B6(K7!#&&MM#~!<o $ 	#		I"#..014c(7m,446c	#` $ 		 Z(  7 su   A	K 	%K /I BK &A"J, 	=J, 9K AJ)K J)%K (J))K ,J?<K >J??K &K+*K+c                   ^^^  [        U5      R                  5       mUUU4S jn[        U [        R                  5      (       a	  U" U 5        g[        R                  " U S5       nU" U5        SSS5        g! , (       d  f       g= f! [
        [        4 a    e [        [        R                  4 a    [        (       a  [        S5      e gf = f)zEEnhanced Zip-Slip protection using Pathlib for cross-platform safety.c                   > Tb  T/OU R                  5       nU H  n[        US5      (       a  UR                  O
[        U5      nSU;   a  [	        SU 35      eTU-  R                  5       nUT:X  a  MZ  UR                  T5      (       a  Mr  ST SU S3n[        (       a  [        U5      e[        R                  " U[        SS9  M     g )	Nfilename zNull byte in ZIP member: r1   z]: Traversal member 'z' detected.r=   r>   )namelistr   r\   r   r   r   r4   rH   rI   rJ   rK   rL   )	zfmembersnamename_strmember_pathrX   rO   specific_memberr7   s	         r)   _audit$validate_zip_archive.<locals>._audit   s    %4%@!bkkm   ,3D*,E,E4==3t98#$'@
%KLL%099;#v-1K1KF1S1S0	9NxjXcdCw-c22 c>aH      rNzZip validation failed)
r   r   r@   zipfileZipFilerI   r   r   
BadZipFilerH   )zip_obj_or_pathtarget_rootrd   rO   re   r_   r7   s     ``  @r)   validate_zip_archivern      s    ;k"**,	I" ow77?##6"r
 766Z( W''( ;7!"9:: ;s7   AB B %	A7.B 7
BB B A C
C   )maxsizec                 |     [         R                  " U S[         R                  S9$ ! [        [        4 a    / s $ f = f)z5Cached hostname resolution to mitigate DNS rebinding.N)proto)socketgetaddrinfoIPPROTO_TCPr   r   )hostnames    r)   _resolve_hostnamerw      s;    !!(D8J8JKKZ  	s   #& ;;c                 Z   U (       a  [        U 5      R                  5       (       d  g [        [        U 5      5      nUR                  S:X  a!  [	        [        UR                  5      U S3S9  gUR                  S;  aD  SU SUR                   S3n[        (       a  [        U5      e[        R                  " U[        S	S
9  g[        UR                  =(       d    S5       H  n[        R                  " US   S   5      nUR                   (       d5  UR"                  (       d$  UR$                  (       d  UR&                  (       d  Me  SU SU 3n[        (       a  [        U5      e[        R                  " U[        S	S
9  M     g! [        [(        4 a    e [*         a    [        (       a  e  gf = f)z-Hardened URL validation with SSRF protection.Nr/   z.file_schemerO   )r,   r-   r1   z]: Unsupported scheme 'z'.r=   r>   r
   r0   r   z!]: SSRF attempt to restricted IP )r   rB   r   rC   rY   r   r   rH   rI   rJ   rK   rL   rw   rv   	ipaddress
ip_addressis_loopbackis_link_localis_multicast
is_privater   rM   )	url_inputrO   rR   rX   resultips         r)   validate_network_urlr      sU   C	N0022#i.)==F"'&++.7)<8PQ== 11&wi/Fv}}oUWX  w%c**c>a@'(=2>F%%fQil3B~~!1!1R__,WI5VWYVZ[7)#..MM#~!D ? Z(  7 s&   AF -AF A?F <F &F*)F*c                   ,   ^  \ rS rSrSrU 4S jrSrU =r$ )_ValidatingRedirectHandler   zIEnsures that every step of a redirect chain is re-validated against SSRF.c                 :   > [        USS9  [        TU ]	  XX4XV5      $ )NNetworkRedirectry   )r   superredirect_request)selfreqfpcoderX   headersnewurl	__class__s          r)   r   +_ValidatingRedirectHandler.redirect_request   s"    V->?w'GLLrg   r;   )__name__
__module____qualname____firstlineno____doc__r   __static_attributes____classcell__r   s   @r)   r   r      s    SM Mrg   r   c                     [        U S5      (       a  U R                  O
[        U 5      n[        USS9  [        R
                  R                  [        5       5      nUR                  " U /UQ70 UD6$ )zCSecure wrapper for urllib.request.urlopen with redirect validation.full_urlzpathsec.urlopenry   )	r   r   r   r   urllibrequestbuild_openerr   open)urlargskwargsurl_stropeners        r)   urlopenr      sY    %c:66cllCHG*;<^^(()C)EFF;;s,T,V,,rg   c                 H    [        U SS9  [        R                  " U 4SU0UD6$ )z!Secure wrapper for builtins.open.zpathsec.openry   mode)rY   builtinsr   )r/   r   r   s      r)   r   r      s%    $/==3D3F33rg   c                   L   ^  \ rS rSrSrU 4S jrSU 4S jjrSU 4S jjrSrU =r	$ )	rj   i  z#Secure wrapper for zipfile.ZipFile.c                 x   > [        U[        [        45      (       a
  [        USS9  [        TU ]  " U/UQ70 UD6  g )Nzpathsec.ZipFilery   )r@   r   r   rY   r   __init__)r   r/   r   r   r   s       r)   r   ZipFile.__init__  s6    dS$K(($(9:///rg   c                 p   > [        X=(       d    [        R                  " 5       US9  [        TU ]  XU5      $ )N)rd   )rn   r   rG   r   extract)r   memberr   pwdr   s       r)   r   ZipFile.extract  s)    T#6299;OwvS11rg   c                 t   > [        X=(       d    [        R                  " 5       5        [        TU ]  XU5        g r3   )rn   r   rG   r   
extractall)r   r   r`   r   r   s       r)   r   ZipFile.extractall  s%    T#6299;74#.rg   r;   )NN)NNN)
r   r   r   r   r   r   r   r   r   r   r   s   @r)   rj   rj     s    -0
2/ /rg   rj   )rY   r   rn   r   r   rj   rH   )NLTKN)NZipAudit)	NetworkIO)rh   ) r   r   rz   r   rs   r   urllib.requestr   rJ   ri   	functoolsr   pathlibr   urllib.parser   r   rH   r   r   r*   rY   rn   rw   r   r   HTTPRedirectHandlerr   r   r   rj   __all__r;   rg   r)   <module>r      s    2 1   	  
      *   %PTp AK!;H 3  FM!C!C M-4/goo /"rg   