ڰj\8 $SrSSKrSSKrSSKrSSKJr SSKJrJrJ r SSK J r J r SSK Jr SSKJr SSKJrJr SS KJr S r\"S 5rS rS rSr\R:"S5/rSr"SS\ 5r!S\"4Sjr#S\$S\"4Sjr%S\$S\&S\\$4Sjr'S\&4Sjr(S\$SS4Sjr)S\$S\$4Sjr*"SS\5r+S \$S\4S!jr,S"\SS4S#jr-S"\SS4S$jr.S%\ \&SS4S&jr/S'\&S%\ \&S\\04S(jr1S\$4S)jr2S*S+SS\S,.S\$S-\"S.\&S/\ \3S%\ \&S0\&4 S1jjr4g)2a PodWorker | serverless | utils | rp_ssrf.py SSRF-safe fetching of user-supplied (job-input) URLs. Job input carries arbitrary URLs that the worker downloads. Without restriction a job can point the worker at cloud instance-metadata (169.254.169.254) or other non-public addresses (CWE-918). This module blocks any destination that is not a globally-routable IP, pins connections to a pre-validated address to defeat DNS rebinding, re-validates redirect hops, and caps download size. Pinning requires this process to open the socket, so a URL that the environment routes through a proxy is refused rather than fetched unprotected; see _refuse_if_proxied. N)suppress)IteratorListOptional)urljoinurlparse)ConnectionError) HTTPAdapter)get_environ_proxies select_proxy)SyncClientSession)httphttps)i-i.i/i3i4RUNPOD_MAX_DOWNLOAD_BYTESlz 100.64.0.0/10"RUNPOD_ALLOW_PRIVATE_DOWNLOAD_URLSc\rSrSrSrSrg) SSRFError0aq Raised when a URL is rejected as unsafe (non-public destination, blocked scheme, or oversized body). Subclasses ValueError and deliberately NOT requests.RequestException so it bypasses the download path's backoff retry and `except RequestException` handler: a blocked internal URL must fail loudly, not be retried or silently reported as an ordinary failed download. N)__name__ __module__ __qualname____firstlineno____doc____static_attributes__r\/home/mande/repo/quber/.venv/lib/python3.13/site-packages/runpod/serverless/utils/rp_ssrf.pyrr0srrreturnc[RR[S5R 5R 5S;$)N)1trueyes)osenvironget_ALLOW_PRIVATE_ENVstriplowerrrr_ssrf_protection_enabledr+<s7 ::>>,b 1 7 7 9 ? ? AJ ripc^[R"U5m[TSS5nUbUm[ U4Sj[ 55(agTR (dUTR(dDTR(d3TR(d"TR(dTR(agTR$![a gf=f)a Return True only for a globally-routable unicast IP address. Blocks loopback, link-local (incl. 169.254.169.254 metadata), RFC1918, CGNAT, reserved, multicast, unspecified, IPv6 unique-local/link-local, and IPv4-mapped IPv6 forms of any of the above. Unparseable input is unsafe. F ipv4_mappedNc3.># UH nTU;v M g7fNr).0networkaddresss r "is_safe_address..Vs E-D'7g -Ds) ipaddress ip_address ValueErrorgetattrany_EXTRA_BLOCKED_NETWORKS is_private is_loopback is_link_local is_reserved is_multicastis_unspecified is_global)r,mappedr3s @ris_safe_addressrDDs&&r* WmT 2F  E-D EEE             ! !   + sB== C  C hostportc[R"X[RS9n/nUH#nUSSnXd;dMUR U5 M% U(d[ SU<35e[ 5(a+UH%n[U5(aM[ SU<S U35e U$![Ran[ SU<SU35UeSnAff=f) ao Resolve `host` and return its IPs, failing closed on any unsafe address. Raises SSRFError if the host cannot be resolved, resolves to nothing, or resolves to any non-global address (a host resolving to both a public and a private IP is treated as hostile). Validation is skipped when the escape hatch env var is set, but resolution still occurs so callers can pin. )typezcould not resolve host : Nrzno addresses resolved for host zhost z resolves to non-public address )socket getaddrinfo SOCK_STREAMgaierrorrappendr+rD)rErFinfoserripsinfor,s rresolve_and_validaterTfsL""4F4F4FGC !WQZ = JJrN 9$BCC!!B"2&&D8#CB4H J' ??L1$C5ABKLs#B""C6C  Cc[RR[5nUc[$[ U5nUS:aU$[$![ a [s$f=f)z4Configured per-download byte cap; defaults to 5 GiB.r)r%r&r'_MAX_BYTES_ENV_DEFAULT_MAX_BYTESintr8)rawvalues rmax_download_bytesr[sX **.. (C {!!"CAI55#55 "!!"s AAAurlc [5(dg[U[U55nU(a[SUSUS[S35eg)a: Reject `url` when the environment routes it through a proxy. Pinning only holds if this process opens the socket: through a proxy the request carries the hostname and the proxy resolves it, so the validated IP is not what gets dialed and the rebind protection silently stops applying. Failing here turns that into a loud, actionable error instead of a false sense of protection. NO_PROXY exclusions are honored (such a host is fetched directly, so pinning still holds), and the escape hatch env var allows the proxied fetch for deployments that accept the trade-off. Nzrefusing to fetch z through proxy z1: IP pinning cannot be enforced via a proxy; set z=true to allow it)r+r r rr()r\proxys r_refuse_if_proxiedr_sX $ % % 1#6 7E  _UG<));(<Xl[TU]"S0UD6 g)Nr) _pinned_ipsuper__init__)selfrjkwargs __class__s rrnPinnedIPAdapter.__init__s# "6"rc j>[UR5URS'[TU]"U40UD6$)NHost)rfr\headersrmsend)rorequestrprqs rrvPinnedIPAdapter.sends."27;;"?w|G.v..rr\c[U5nURS:XaMURUl[ UR =(d 05UlURUR S'UR UlU$)Nrserver_hostname)rschemerdassert_hostnamedictconn_kwrlrE)ropoolr\res r_pinPinnedIPAdapter._pins[# ==G ##)??D  23DL.4ooDLL* +OO  rcV>[TU]XX4S9nURXQR5$)N)proxiescert)rmget_connection_with_tls_contextrr\)rorwverifyrrrrqs rr/PinnedIPAdapter.get_connection_with_tls_contexts1w6 W7 yy{{++rc@>[TU]XS9nURX15$)N)r)rmget_connectionr)ror\rrrqs rrPinnedIPAdapter.get_connections$w%c%;yy##r)rl)NNr0) rrrrrstrrnrvrrrr __classcell__)rqs@rrhrhs4###/c, $$rrhrjcx[5n[U5nURSU5 URSU5 U$)z:A session whose http(s) connections dial only `pinned_ip`.zhttp://zhttps://)r rhmount)rjsessionadapters r_build_pinned_sessionrs5!Gi(G MM)W% MM*g& Nrrcv[[5 UR5 SSS5 g!,(df  g=f)a Close a pinned session best-effort, tolerating teardown errors. This runs only on cleanup paths (a failed request, a closing response) where the caller's original exception is the meaningful one. A failure while closing the session's connection pools must not mask that exception, so it is suppressed rather than raised. Session.close() is idempotent and does no actionable I/O, so nothing worth surfacing is lost. N)r Exceptionclose)rs r_close_session_quietlyrs! )     s* 8c:^^URmUU4SjnX lg)a Tie `session` cleanup to `response.close()`. Each safe_get() call owns a single-use session; the caller only holds the response. Closing a requests.Response releases its connection but not the session (its adapters and connection pools), so without this the session leaks one set of pooled sockets/FDs per download in a long-lived worker. Wrapping close() makes `with safe_get(...) as r:` (and any direct response.close()) tear down both. cN>T"U0UD6 [T5 g![T5 f=fr0)r)argsrporiginal_closers r close_both-_bind_session_to_response..close_both s' , D +F + "7 + "7 +s $N)r)responserrrs ` @r_bind_session_to_responsers^^N,  Nr max_bytescUcgURRS5nUcg[U5nX1:a"UR 5 [ SUSUS35eg![a gf=f)NzContent-Lengthzdownload exceeds size cap: z >  bytes)rur'rXr8rr)rrdeclaredsizes r_enforce_content_lengthrs##$45H8} 5dV3ykPQQ s A A%$A% chunk_sizec## SnURUS9HEnU(dM U[U5- nUb$X2:aUR5 [SUS35eUv MG g7f)z Yield the response body in chunks, aborting with SSRFError if the running total exceeds `max_bytes`. Guards against a lying/absent Content-Length. r)rNzdownload exceeds size cap: >r) iter_contentlenrr)rrrtotalchunks riter_content_cappedr"sg E&&*&=  U  U%6 NN :9+VLM M >sAAc SnUH%n[U5nURUUSUUS9nXx4s $ Uc[ SU35eUe![an [U5 U nSn A MYSn A f[a [U5 ef=f)u GET `url` pinned to each validated IP in turn, returning the first that connects. A hostname commonly resolves to several addresses (dual-stack AAAA + A), and the first one may be unroutable from the worker — e.g. an IPv6 address on a pod with no IPv6 route. Plain requests walks the address list; pinning to a single IP would turn that into a hard download failure, so this preserves the fallback while keeping every candidate pre-validated. Only connection-level errors advance to the next address; an HTTP response (any status) or any other exception is returned/raised immediately. Returns the (session, response) pair so the caller owns teardown. Raises the last connection error if no address is reachable. NF)ruallow_redirectsstreamtimeoutz&no candidate addresses to connect to: )rr'RequestsConnectionErrorr BaseExceptionr) rRr\rurr last_errorr,rrrQs r_get_via_first_reachable_ipr2sJ'+ {{ % #H  #&@FGG '  "7 +J   "7 +  sA A8 AA8T)rrrur max_redirectsrrrurc Uc [5nUn[US-5GH8n[U5nUR[;a[ SUR<SU35eUR (d[ SU35e[U5 UR=(d URS:XaSOSn [UR U 5n [XX1US9upU R[;aZU RRS 5n U R5 [!U 5 U (d[ S U35e[#Xm5nGM![%X5 ['X5 U s $ [ S US U35e![!U 5 f=f) a Fetch a user-supplied URL with SSRF protections. Enforces an http(s) scheme allowlist, resolves and validates the host to a public IP, pins the connection to that IP, and re-validates every redirect hop. Rejects a body whose declared size exceeds the cap. Returns the (streamed) requests.Response for the caller to consume; use iter_content_capped to enforce the cap while reading. Raises SSRFError on any block. zblocked URL scheme rIzURL has no host: riP)rurrLocationz"redirect without Location header: zexceeded maximum redirects (z): )r[rangerr{_ALLOWED_SCHEMESrrdr_rFrTr status_code_REDIRECT_STATUSrur'rrrrr)r\rrrurrcurrent_rerFrRrrlocations rsafe_getrZsa&&( G =1$ %'" == 0 01&--1B"WINO O/y9: :7#{{Gfmmw&>sB"6??D97 ''    #3 3''++J7H 0 &w/"DWI NOOg0G  "(44=&@ 2=/SEJ KK'w/s E,, E9)5rr6r%rK contextlibrtypingrrr urllib.parserrrequestsr rrequests.adaptersr requests.utilsr r runpod.http_clientr r frozensetr_DEFAULT_MAX_REDIRECTSrVrW ip_networkr;r(r8rboolr+rrDrXrTr[r_rfrhrrrrbytesrrr}rrrrrs  ++*?)<0$67-"%//@A:  $Ds#$s)B 6C 6 C D 2##&$$k$$NS-> $5 $  1B t , R# R4 R c hsm PXY^P_  %#%V"#/7L 7L 7L 7L d^ 7L } 7L7Lr