+
    ûwÖiJ  ã                   óˆ   € R t ^ RIt^ RIHtHt ^ RIHt ^ RIHt ]P                  ! ]
4      t ! R R]4      t ! R R4      tR# )	z3DNS rebinding protection for MCP server transports.N)Ú	BaseModelÚField)ÚRequest)ÚResponsec                   ól   a € ] tR t^t o Rt]! RRR7      t]! . RR7      t]! . R	R7      tV 3R lt	Rt
V tR# )
ÚTransportSecuritySettingsz‘Settings for MCP transport security features.

These settings help protect against DNS rebinding attacks by validating
incoming request headers.
Tz<Enable DNS rebinding protection (recommended for production))ÚdefaultÚdescriptionc                ó^   <€ V ^8„  d   Qh/ S[ ;R&   S[S[,          ;R&   S[S[,          ;R&   # )é   Úenable_dns_rebinding_protectionÚallowed_hostsÚallowed_origins)ÚboolÚlistÚstr)ÚformatÚ__classdict__s   "€ÚQ/home/ubuntu/.local/lib/python3.14/site-packages/mcp/server/transport_security.pyÚ__annotate__Ú&TransportSecuritySettings.__annotate__   s:   ø‡ ‚ ñ &*ñ ñ ñ ™•9ñ ñ ñ$ ™#•Yñ ò% ó    © Nz^List of allowed Host header values. Only applies when enable_dns_rebinding_protection is True.z`List of allowed Origin header values. Only applies when enable_dns_rebinding_protection is True.)Ú__name__Ú
__module__Ú__qualname__Ú__firstlineno__Ú__doc__r   r   r   r   Ú__annotate_func__Ú__static_attributes__Ú__classdictcell__©r   s   @r   r   r      sL   ø‡ € ññ -2ØØRô-Ð#ñ
  %Øð5ô €Mñ "'Øð5ô"€O÷% ƒ r   r   c                   ó†   a € ] tR t^%t o RtRV 3R lR lltV 3R lR ltV 3R lR ltV 3R	 lR
 ltRV 3R lR llt	Rt
V tR# )ÚTransportSecurityMiddlewarezKMiddleware to enforce DNS rebinding protection for MCP transport endpoints.Nc                ó.   <€ V ^8„  d   QhRS[ R,          /# )r   ÚsettingsN)r   )r   r   s   "€r   r   Ú(TransportSecurityMiddleware.__annotate__(   s   ø€ ÷ eñ eÑ!:¸TÕ!Añ er   c                ó<   € T;'       g    \        R R7      V n        R# )F)r   N)r   r%   )Úselfr%   s   &&r   Ú__init__Ú$TransportSecurityMiddleware.__init__(   s   € ð !×dÐdÔ$=Ð^cÔ$dˆŽr   c                ó4   <€ V ^8„  d   QhRS[ R,          RS[/# )r   ÚhostNÚreturn©r   r   )r   r   s   "€r   r   r&   -   s   ø€ ÷ ñ ¡3¨¥:ð ±$ñ r   c                ód  € V'       g   \         P                  R4       R# WP                  P                  9   d   R# V P                  P                   FB  pVP	                  R4      '       g   K  VRR pVP                  VR,           4      '       g   KA   R# 	  \         P                  RV 24       R# )	z0Validate the Host header against allowed values.zMissing Host header in requestFTú:*NÚ:zInvalid Host header: éþÿÿÿ)ÚloggerÚwarningr%   r   ÚendswithÚ
startswith)r(   r,   ÚallowedÚ	base_hosts   &&  r   Ú_validate_hostÚ*TransportSecurityMiddleware._validate_host-   s‹   € çÜN‰NÐ;Ô<Ùð —=‘=×.Ñ.Ô.Ùð —}‘}×2Ô2ˆGØ×Ñ ×%Ô%à# C R˜L	à—?‘? 9¨s¥?×3Ô3Úñ 3ô 	‰Ð.¨t¨fÐ5Ô6Ùr   c                ó4   <€ V ^8„  d   QhRS[ R,          RS[/# )r   ÚoriginNr-   r.   )r   r   s   "€r   r   r&   C   s   ø€ ÷ ñ ¡s¨T¥zð ±dñ r   c                ó:  € V'       g   R# WP                   P                  9   d   R# V P                   P                   FB  pVP                  R4      '       g   K  VRR pVP                  VR,           4      '       g   KA   R# 	  \        P                  RV 24       R# )z2Validate the Origin header against allowed values.Tr0   Nr1   zInvalid Origin header: Fr2   )r%   r   r5   r6   r3   r4   )r(   r<   r7   Úbase_origins   &&  r   Ú_validate_originÚ,TransportSecurityMiddleware._validate_originC   sƒ   € ÷ Ùð —]‘]×2Ñ2Ô2Ùð —}‘}×4Ô4ˆGØ×Ñ ×%Ô%à% c r˜là×$Ñ$ [°3Õ%6×7Ô7Úñ 5ô 	‰Ð0°°Ð9Ô:Ùr   c                ó4   <€ V ^8„  d   QhRS[ R,          RS[/# )r   Úcontent_typeNr-   r.   )r   r   s   "€r   r   r&   Y   s   ø€ ÷ ñ ±3¸µ:ð Á$ñ r   c                óÂ   € V'       g   \         P                  R4       R# VP                  4       P                  R4      '       g   \         P                  RV 24       R# R# )z3Validate the Content-Type header for POST requests.z+Missing Content-Type header in POST requestFzapplication/jsonzInvalid Content-Type header: T)r3   r4   Úlowerr6   )r(   rB   s   &&r   Ú_validate_content_typeÚ2TransportSecurityMiddleware._validate_content_typeY   sL   € çÜN‰NÐHÔIÙð ×!Ñ!Ó#×.Ñ.Ð/A×BÒBÜN‰NÐ:¸<¸.ÐIÔJÙár   c                ó:   <€ V ^8„  d   QhRS[ RS[RS[R,          /# )r   ÚrequestÚis_postr-   N)r   r   r   )r   r   s   "€r   r   r&   f   s)   ø€ ÷ ñ ©gð Áð ÑQYÐ\`ÕQ`ñ r   c              ƒ  óÔ  "  € V'       d@   VP                   P                  R4      pV P                  V4      '       g   \        RRR7      # V P                  P
                  '       g   R# VP                   P                  R4      pV P                  V4      '       g   \        RRR7      # VP                   P                  R	4      pV P                  V4      '       g   \        R
RR7      # R# 5i)z…Validate request headers for DNS rebinding protection.

Returns None if validation passes, or an error Response if validation fails.
zcontent-typezInvalid Content-Type headeri  )Ústatus_codeNr,   zInvalid Host headeri¥  r<   zInvalid Origin headeri“  )ÚheadersÚgetrE   r   r%   r   r9   r?   )r(   rH   rI   rB   r,   r<   s   &&&   r   Úvalidate_requestÚ,TransportSecurityMiddleware.validate_requestf   s¿   é € ÷ Ø"Ÿ?™?×.Ñ.¨~Ó>ˆLØ×.Ñ.¨|×<Ò<ÜÐ =È3ÔOÐOð }‰}×<×<Ð<Ùð ‰×"Ñ" 6Ó*ˆØ×"Ñ" 4×(Ò(ÜÐ1¸sÔCÐCð —‘×$Ñ$ XÓ.ˆØ×$Ñ$ V×,Ò,ÜÐ3ÀÔEÐEáùs   ‚:C(½(C(Á&3C(Â>C(ÃC()r%   )N)F)r   r   r   r   r   r)   r9   r?   rE   rN   r   r    r!   s   @r   r#   r#   %   sA   ø‡ € ÙU÷eò e÷
ð ÷,ð ÷,ð ÷÷ ð r   r#   )r   ÚloggingÚpydanticr   r   Ústarlette.requestsr   Ústarlette.responsesr   Ú	getLoggerr   r3   r   r#   r   r   r   Ú<module>rU      s<   ðÙ 9ã ç %Ý &Ý (à	×	Ò	˜8Ó	$€ô 	ô ÷2Zó Zr   