Ë
    çÍ:j'  ã                   ó:  — d Z 	 ddlZddlZddlZddlZddlZddlZddlZddl	Z	ddl
mZ ddlmZ ddlmZmZ dZdadad„ Zdd„Z	 dd	„Z ed
¬«      d„ «       Zdd„Z G d„ dej2                  j4                  «      Zd„ Zdd„Z G d„ de	j<                  «      Zg d¢Zy)z+Centralized I/O security sentinel for NLTK.é    N)Ú	lru_cache)ÚPath)ÚunquoteÚurlparseFc                  ó(  — g } dt         j                  v r't        t        t         j                  d   dg «      «      } t        j
                  j                  dd«      }| |f}t        �t        |k(  rt        S t        «       }| |j                  t        j                  «      z   D ]Q  }|sŒ	 t        |d«      r|j                  n|}|j                  t        t!        |«      «      j#                  «       «       ŒS ddl}dd|j-                  «       fD ]K  }	 t        |«      j/                  «       j#                  «       }|j1                  «       r|j                  |«       ŒM |a|a|S # t$        t&        t(        f$ r Y ŒÕw xY w# t$        t&        t(        f$ r Y Œ„w xY w)	zDDynamically determines allowed directories based on NLTK data paths.z	nltk.dataÚpathÚ	NLTK_DATAÚ Nr   z~/nltk_dataz/usr/share/nltk_data)ÚsysÚmodulesÚlistÚgetattrÚosÚenvironÚgetÚ_ALLOWED_ROOTS_CACHEÚ_LAST_DATA_PATHSÚsetÚsplitÚpathsepÚhasattrr   Úaddr   ÚstrÚresolveÚOSErrorÚ
ValueErrorÚRuntimeErrorÚtempfileÚ
gettempdirÚ
expanduserÚexists)Úcurrent_pathsÚ	env_pathsÚcurrent_stateÚrootsÚpÚraw_pr   Úlocs           úa/home/mcse/projects/srt_converter/srt-converter-venv/lib/python3.12/site-packages/nltk/pathsec.pyÚ_get_allowed_rootsr*      sg  € ð €MØ”c—k‘kÑ!äœW¤S§[¡[°Ñ%=¸vÀrÓJÓKˆä—
‘
—‘˜{¨BÓ/€IØ" IÐ.€MäÐ'Ô,<ÀÒ,MÜ#Ð#ä‹E€EØ˜YŸ_™_¬R¯Z©ZÓ8Ñ8ò ˆÚðä")¨!¨VÔ"4˜Ÿš¸!�Ø—	‘	œ$œs 5›zÓ*×2Ñ2Ó4Õ5ðó àÐ5°x×7JÑ7JÓ7LÐMò ˆð	Ü�S“	×$Ñ$Ó&×.Ñ.Ó0ˆAØ�x‰xŒzØ—	‘	˜!”øð	ð !ÐØ$ÐØ€Løô œZ¬Ð6ò Ùðûô œ¤\Ð2ò 	Ùð	ús&   Â(AE ÄAE:Å E7Å6E7Å:FÆFc                 ó>  ‡‡— t        | t        «      s| rt        | «      j                  «       sy	 t	        | d«      r| j
                  n
t        | «      }d|v r>t        |«      }|j                  dv ry|j                  dk(  rt        |j
                  «      }	 t        |«      j                  «       Š|rft	        |d«      r|j
                  n
t        |«      }t        |«      j                  «       }‰|k(  s%‰j                  |«      st        d|› d	‰› d
|› �«      ‚t!        «       }	t#        ˆfd„|	D «       «      ry	 t        t%        j&                  «       «      j                  «       Š‰‰k(  s‰j                  ‰«      rPt#        ˆfd„|	D «       «      ryd|› d�}
t(        rt+        |
«      ‚t-        j.                  d|› d	‰› d�t0        d¬«       y	 d|› d‰› �}
t(        rt+        |
«      ‚t-        j.                  |
t0        d¬«       y# t        t        f$ rT |j                  «       }d|v r1|j                  d«      dz   }t        |d| «      j                  «       Šnt        |«      ŠY �Œ²w xY w# t        t        f$ r Y Œ­w xY w# t*        t        f$ r ‚ t2        $ r
 t(        r‚ Y yw xY w)aG  
    Ensures file access is restricted to allowed data directories.

    :param path_input: The path to validate.
    :param context: Diagnostic context for warnings/errors.
    :param required_root: If provided, enforces that the path is strictly
                          within this specific directory (scoped sandbox).
    Nr   z://)ÚhttpÚhttpsÚftpÚfilez.zipé   úSecurity Violation [z]: Path z escapes root c              3   óN   •K  — | ]  }‰|k(  xs ‰j                  |«      –— Œ y ­w©N)Úis_relative_to)Ú.0ÚrootÚtargets     €r)   ú	<genexpr>z validate_path.<locals>.<genexpr>x   s(   øè ø€ ÒWÀˆv˜‰~Ò< ×!6Ñ!6°tÓ!<Ó<ÑWùs   ƒ"%c              3   ó(   •K  — | ]	  }‰|k(  –— Œ y ­wr3   © )r5   r6   Úcwds     €r)   r8   z validate_path.<locals>.<genexpr>   s   øè ø€ Ò= t�s˜d•{Ñ=ùs   ƒzS]: CWD access restricted in ENFORCE mode. Authorize via: nltk.data.path.append('.')zSecurity Warning [z allowed via CWD.é   ©Ú
stacklevelz]: Unauthorized path )Ú
isinstanceÚintr   Ústripr   r   r   Úschemer   r   r   r   r   ÚlowerÚfindr4   r*   Úanyr   ÚgetcwdÚENFORCEÚPermissionErrorÚwarningsÚwarnÚRuntimeWarningÚ	Exception)Ú
path_inputÚcontextÚrequired_rootÚrawÚparsedÚ	lower_rawÚzip_idxÚroot_rawÚscoped_rootÚallowed_rootsÚmsgr;   r7   s              @@r)   Úvalidate_pathrX   F   s•  ù€ ô �*œcÔ"©*¼CÀ
»O×<QÑ<QÔ<SØðIÜ!(¨°VÔ!<ˆj�oŠoÄ#ÀjÃ/ˆà�C‰<Ü˜c“]ˆFØ�}‰}Ð 8Ñ8ØØ�}‰} Ò&Ü˜fŸk™kÓ*�ð		#Ü˜#“Y×&Ñ&Ó(ˆFñ ô ˜=¨&Ô1ð ×"Ò"ä˜Ó'ð ô
 ˜x›.×0Ñ0Ó2ˆKØ˜kÒ)¨V×-BÑ-BÀ;Ô-Oä Ø*¨7¨)°8¸F¸8À>ÐR]ÐQ^Ð_óð ô
 +Ó,ˆÜÓWÈÔWÔWØð	Ü”r—y‘y“{Ó#×+Ñ+Ó-ˆCØ˜Š} × 5Ñ 5°cÔ :ÜÓ=¨}Ô=Ô=Øà*¨7¨)ð 4@ð @ð õ Ü)¨#Ó.Ð.ä—M‘MØ,¨W¨I°X¸f¸XÐEVÐWÜ&Ø#$õð
 ð !;ð& % W IÐ-BÀ6À(ÐKˆÝÜ! #Ó&Ð&ä�M‰M˜#œ~¸!Ö<øôo œÐ$ò 	#àŸ	™	›ˆIØ˜Ñ"Ø#Ÿ.™.¨Ó0°1Ñ4�Ü˜c ( 7˜mÓ,×4Ñ4Ó6‘ä˜c›�úð	#ûô` œÐ$ò 	Ùð	ûô œZÐ(ò ØÜò ÝØñ ðúsi   °A I: Á1$I: ÂG? Â/BI: Ä7AI% Æ:I% Ç6I: Ç?AI"ÉI: É!I"É"I: É%I7É4I: É6I7É7I: É:JÊJc                 óv  ‡‡‡— 	 t        |«      j                  «       Šˆˆˆfd„}t        | t        j                  «      r	 || «       yt        j                  | d«      5 } ||«       ddd«       y# 1 sw Y   yxY w# t
        t        f$ r ‚ t        t        j                  f$ r t        rt        d«      ‚Y yw xY w)zEEnhanced Zip-Slip protection using Pathlib for cross-platform safety.c                 ój  •— ‰�‰gn| j                  «       }|D ]˜  }t        |d«      r|j                  n
t        |«      }d|v rt	        d|› �«      ‚‰|z  j                  «       }|‰k(  rŒQ|j                  ‰«      rŒcd‰› d|› d�}t        rt        |«      ‚t        j                  |t        d¬«       Œš y )	NÚfilenameú zNull byte in ZIP member: r1   z]: Traversal member 'z' detected.r<   r=   )Únamelistr   r[   r   r   r   r4   rG   rH   rI   rJ   rK   )	ÚzfÚmembersÚnameÚname_strÚmember_pathrW   rN   Úspecific_memberr7   s	         €€€r)   Ú_auditz$validate_zip_archive.<locals>._audit¤   s½   ø€ à%4Ð%@�Ñ!ÀbÇkÁkÃmð ð  ò I�Ü,3°D¸*Ô,E˜4Ÿ=š=Ì3ÈtË9�Ø˜8Ñ#Ü$Ð'@ÀÀ
Ð%KÓLÐLà%¨Ñ0×9Ñ9Ó;�Ø# vÓ-°×1KÑ1KÈFÕ1SØ0°°	Ð9NÈxÈjÐXcÐd�CÝÜ-¨cÓ2Ð2ä Ÿ™ c¬>ÀaÖHñIó    ÚrNzZip validation failed)
r   r   r?   ÚzipfileÚZipFilerH   r   r   Ú
BadZipFilerG   )Úzip_obj_or_pathÚtarget_rootrc   rN   rd   r^   r7   s     ``  @r)   Úvalidate_zip_archiverl   �   s¢   ú€ ð;Ü�kÓ"×*Ñ*Ó,ˆö	Iô" �o¤w§¡Ô7Ù�?Õ#ä—‘ °#Ó6ð ¸"Ù�r”
÷÷ ñ ûäœZÐ(ò ØÜ”W×'Ñ'Ð(ò ;ÝÜ!Ð"9Ó:Ð:ñ ð;ús6   …AA< ÁA< Á	A0Á'A< Á0A9Á5A< Á9A< Á<9B8Â7B8é   )Úmaxsizec                 ó~   — 	 t        j                  | dt         j                  ¬«      S # t        t        f$ r g cY S w xY w)z5Cached hostname resolution to mitigate DNS rebinding.N)Úproto)ÚsocketÚgetaddrinfoÚIPPROTO_TCPr   r   )Úhostnames    r)   Ú_resolve_hostnameru   Á   s;   € ðÜ×!Ñ! (¨D¼×8JÑ8JÔKÐKøÜ”ZÐ ò ØŠ	ðús   ‚%( ¨<»<c                 óò  — | rt        | «      j                  «       sy	 t        t        | «      «      }|j                  dk(  r$t	        t        |j                  «      |› d�¬«       y|j                  dvrAd|› d|j                  › d�}t        rt        |«      ‚t        j                  |t        d	¬
«       yt        |j                  xs d«      D ]ƒ  }t        j                  |d   d   «      }|j                   s%|j"                  s|j$                  s|j&                  sŒOd|› d|› �}t        rt        |«      ‚t        j                  |t        d	¬
«       Œ… y# t        t(        f$ r ‚ t*        $ r
 t        r‚ Y yw xY w)z-Hardened URL validation with SSRF protection.Nr/   z.file_scheme©rN   )r,   r-   r1   z]: Unsupported scheme 'z'.r<   r=   r
   r0   r   z!]: SSRF attempt to restricted IP )r   rA   r   rB   rX   r   r   rG   rH   rI   rJ   rK   ru   rt   Ú	ipaddressÚ
ip_addressÚis_loopbackÚis_link_localÚis_multicastÚ
is_privater   rL   )Ú	url_inputrN   rQ   rW   ÚresultÚips         r)   Úvalidate_network_urlr�   Ê   sQ  € áœC 	›N×0Ñ0Ô2ØðÜœ#˜i›.Ó)ˆØ�=‰=˜FÒ"Üœ' &§+¡+Ó.¸7¸)À<Ð8PÕQØà�=‰=Ð 1Ñ1à& w iÐ/FÀvÇ}Á}ÀoÐUWÐXð õ Ü% cÓ*Ð*ä—‘˜c¤>¸aÕ@Øä'¨¯©Ò(=¸2Ó>ò 	EˆFÜ×%Ñ% f¨Q¡i°¡lÓ3ˆBØ�~Š~ ×!1Ò!1°R·_²_ÈÏËØ,¨W¨IÐ5VÐWYÐVZÐ[�ÝÜ)¨#Ó.Ð.ä—M‘M #¤~À!ÖDñ	Eøô œZÐ(ò ØÜò ÝØñ ðús&   žAE Á%AE Â4A'E Ä7E ÅE6Å5E6c                   ó"   ‡ — e Zd ZdZˆ fd„Zˆ xZS )Ú_ValidatingRedirectHandlerzIEnsures that every step of a redirect chain is re-validated against SSRF.c                 óF   •— t        |d¬«       t        ‰| �	  ||||||«      S )NÚNetworkRedirectrw   )r�   ÚsuperÚredirect_request)ÚselfÚreqÚfpÚcoderW   ÚheadersÚnewurlÚ	__class__s          €r)   r‡   z+_ValidatingRedirectHandler.redirect_requestð   s(   ø€ Ü˜VÐ->Õ?Ü‰wÑ'¨¨R°°s¸GÀVÓLÐLre   )Ú__name__Ú
__module__Ú__qualname__Ú__doc__r‡   Ú__classcell__©rŽ   s   @r)   rƒ   rƒ   í   s   ø„ ÙS÷Mð Mre   rƒ   c                 óÜ   — t        | d«      r| j                  n
t        | «      }t        |d¬«       t        j
                  j                  t        «       «      } |j                  | g|¢­i |¤ŽS )zCSecure wrapper for urllib.request.urlopen with redirect validation.Úfull_urlzpathsec.urlopenrw   )	r   r–   r   r�   ÚurllibÚrequestÚbuild_openerrƒ   Úopen)ÚurlÚargsÚkwargsÚurl_strÚopeners        r)   Úurlopenr    õ   sX   € ä% c¨:Ô6ˆc�lŠl¼CÀ»H€GÜ˜Ð*;Õ<Ü�^‰^×(Ñ(Ô)CÓ)EÓF€FØˆ6�;‰;�sÐ,˜TÒ, VÑ,Ð,re   c                 óL   — t        | d¬«       t        j                  | fd|i|¤ŽS )z!Secure wrapper for builtins.open.zpathsec.openrw   Úmode)rX   Úbuiltinsrš   )r/   r¢   r�   s      r)   rš   rš   ý   s%   € ä�$ Õ/Ü�=‰=˜Ñ3 DÐ3¨FÑ3Ð3re   c                   ó:   ‡ — e Zd ZdZˆ fd„Zdˆ fd„	Zdˆ fd„	Zˆ xZS )rh   z#Secure wrapper for zipfile.ZipFile.c                 ór   •— t        |t        t        f«      rt        |d¬«       t	        ‰| �  |g|¢­i |¤Ž y )Nzpathsec.ZipFilerw   )r?   r   r   rX   r†   Ú__init__)rˆ   r/   rœ   r�   rŽ   s       €r)   r¦   zZipFile.__init__  s3   ø€ Ü�dœS¤$˜KÔ(Ü˜$Ð(9Õ:Ü‰Ñ˜Ð/ Ò/¨Ó/re   c                 ón   •— t        | |xs t        j                  «       |¬«       t        ‰| �  |||«      S )N)rc   )rl   r   rF   r†   Úextract)rˆ   Úmemberr   ÚpwdrŽ   s       €r)   r¨   zZipFile.extract  s-   ø€ Ü˜T 4Ò#6¬2¯9©9«;ÈÕOÜ‰w‰˜v t¨SÓ1Ð1re   c                 ól   •— t        | |xs t        j                  «       «       t        ‰| �  |||«       y r3   )rl   r   rF   r†   Ú
extractall)rˆ   r   r_   rª   rŽ   s       €r)   r¬   zZipFile.extractall  s)   ø€ Ü˜T 4Ò#6¬2¯9©9«;Ô7Ü‰Ñ˜4 ¨#Õ.re   )NN)NNN)r�   r�   r‘   r’   r¦   r¨   r¬   r“   r”   s   @r)   rh   rh     s   ø„ Ù-ô0õ
2÷/ñ /re   rh   )rX   r�   rl   rš   r    rh   rG   )ÚNLTKN)NÚZipAudit)Ú	NetworkIO)rf   ) r’   r£   rx   r   rq   r   Úurllib.requestr—   rI   rg   Ú	functoolsr   Úpathlibr   Úurllib.parser   r   rG   r   r   r*   rX   rl   ru   r�   r˜   ÚHTTPRedirectHandlerrƒ   r    rš   rh   Ú__all__r:   re   r)   ú<module>r¶      s³   ðñ 2à 1Û Û Û 	Û Û 
Û Û Û Ý Ý ß *ð €àÐ ØÐ ò%óPTðp AKó!;ñH �3Ôñó ðó ôFM §¡×!CÑ!Cô Mò-ó4ô/ˆg�o‰oô /ò"�re   