Ë
    çÍ:jš  ã                   óÀ   — d dl Z d dlZd dlZd dlZd dlZd dlmZmZ d dlZd dl	Z
d dl	mZ  ej                  d¬«      d„ «       Zd„ Zd„ Zd	„ Zd
„ Zd„ Zd„ Zd„ Zd„ Zd„ Zy)é    N)Ú	HTTPErrorÚURLError)Ú
DownloaderT)Úautousec               #   ó´   K  — 	 ddl } | j                  j                  }d| j                  _        d–— || j                  _        y# t        $ r d–— Y yw xY w­w)zt
    Dynamically toggle enforcement if pathsec exists.
    If on a branch without pathsec.py, proceed normally.
    r   NT)Únltk.pathsecÚpathsecÚENFORCEÚImportError)ÚnltkÚoriginal_enforces     úp/home/mcse/projects/srt_converter/srt-converter-venv/lib/python3.12/site-packages/nltk/test/unit/test_pathsec.pyÚenable_enforcementr      sJ   è ø€ ðÛàŸ<™<×/Ñ/ÐØ#ˆ�‰ÔÛØ/ˆ�‰ÕøÜò Ýðüs)   ‚A„A A ÁAÁAÁAÁAÁAc                  ó\   — t        d¬«      } 	 | j                  «        y # t        $ r Y y w xY w)NzChttps://raw.githubusercontent.com/nltk/nltk_data/gh-pages/index.xml©Úserver_index_url)r   Úindexr   ©Údls    r   Útest_valid_http_urlr   "   s/   € Ü	Ø^ô
€BðØ
�‰�
øÜò Ùðús   Ž Ÿ	+ª+c                  ó¤   — t        d¬«      } t        j                  t        t        f«      5  | j                  «        d d d «       y # 1 sw Y   y xY w)Nzfile:///etc/passwdr   ©r   ÚpytestÚraisesÚ
ValueErrorÚPermissionErrorr   r   s    r   Útest_ssrf_invalid_schemer   ,   s<   € Ü	Ð%9Ô	:€BÜ	�‰œ
¤OÐ4Ó	5ñ Ø
�‰Œ
÷÷ ñ úó   ¬AÁAc                  ó¤   — t        d¬«      } t        j                  t        t        f«      5  | j                  «        d d d «       y # 1 sw Y   y xY w)Nzhttp://127.0.0.1/adminr   r   r   s    r   Útest_ssrf_loopback_ipr    2   s<   € Ü	Ð%=Ô	>€BÜ	�‰œ
¤OÐ4Ó	5ñ Ø
�‰Œ
÷÷ ñ úr   c                  ó¤   — t        d¬«      } t        j                  t        t        f«      5  | j                  «        d d d «       y # 1 sw Y   y xY w)Nz(http://169.254.169.254/latest/meta-data/r   r   r   s    r   Ú#test_ssrf_cloud_metadata_link_localr"   8   s<   € Ü	Ð%OÔ	P€BÜ	�‰œ
¤OÐ4Ó	5ñ Ø
�‰Œ
÷÷ ñ úr   c                  óŠ  — t        d¬«      } 	 | j                  «        t        j                  d«       y# t        t
        f$ r Y yt        $ r"}t        j                  d|› �«       Y d}~yd}~wt        $ rL}t        |j                  t        j                  «      rnt        j                  d|› �«       Y d}~yY d}~yd}~ww xY w)zNWill FAIL on PR #3520 (on Unix) because string-matching misses the decimal IP.z#http://2852039166/latest/meta-data/r   z2Request succeeded entirely, bypassing all filters.z1Vulnerability bypassed localized string filters: NzUnexpected network failure: )r   r   r   Úfailr   r   r   r   Ú
isinstanceÚreasonÚsocketÚgaierror)r   Úes     r   Útest_ssrf_ip_obfuscationr*   >   sš   € ä	Ð%JÔ	K€Bð<Ø
�‰Œ
Ü�‰ÐHÕIøÜœÐ(ò áÜò Mä�‰ÐGÈÀsÐK×LÑLûÜò <ä�a—h‘h¤§¡Ô0Øä�K‰KÐ6°q°cÐ:×;Ñ;ô ûð<ús'   Ž%4 ´CÁCÁA*Á*CÁ6=B=Â=Cc                  ób  — 	 ddl m}  t        j
                  j                  t        j
                  j                  t        j                  «      dd«      }t        j                  t        t        f«      5   | |d«       ddd«       y# t        $ r t        j                  } Y Œ™w xY w# 1 sw Y   yxY w)z¯
    Test if absolute paths bypass standard relative traversal checks.
    Will FAIL on vulnerable branches because standard builtins.open does not check path boundaries.
    r   )ÚopenÚ_nltk_pathsec_testz
secret.txtÚrN)r   r,   r   ÚbuiltinsÚosÚpathÚjoinÚabspathÚsepr   r   r   r   )Útarget_openÚoutsides     r   Útest_path_traversal_absoluter7   U   sƒ   € ð
$Ý4ô �g‰g�l‰lœ2Ÿ7™7Ÿ?™?¬2¯6©6Ó2Ð4HÈ,ÓW€GÜ	�‰œ
¤OÐ4Ó	5ñ "Ù�G˜SÔ!÷"ð "øô ò $Ü—m‘mŠð$ú÷"ð "ús   ‚B Á3
B%ÂB"Â!B"Â%B.c                 óô   — t        j                  «       }t        j                  |d«      5 }t        j                  | «      }|j                  |d«       ddd«       |j                  d«       |S # 1 sw Y   ŒxY w)z/Helper to create malicious zip files in memory.Úws   malicious contentNr   )ÚioÚBytesIOÚzipfileÚZipFileÚZipInfoÚwritestrÚseek)ÚfilenameÚmem_zipÚzfÚzinfos       r   Úcreate_malicious_ziprE   j   sa   € ä�j‰j‹l€GÜ	�‰˜ #Ó	&ð 1¨"Ü—‘ Ó)ˆØ
�‰�EÐ/Ô0÷1ð ‡L�L�„OØ€N÷	1ð 1ús   «(A.Á.A7c                 ó2  — t        t        j                  dt        j                  «      }t        d«      }t        j                  t        t        f«      5   ||d«      5 }|j                  | «       ddd«       ddd«       y# 1 sw Y   ŒxY w# 1 sw Y   yxY w)zÉ
    Test standard ../ Zip-Slip traversal.
    Will FAIL on PR #3520 because standard zipfile silently sanitizes/ignores
    the traversal rather than proactively blocking it and raising an alert.
    r=   z../../../evil.shr.   N©Úgetattrr   Ú
downloaderr<   r=   rE   r   r   r   r   Ú
extractall©Útmp_pathÚTargetZipFileÚmalicious_ziprC   s       r   Útest_zip_slip_traversalrO   t   s}   € ô œDŸO™O¨Y¼¿¹ÓH€Mä(Ð);Ó<€MÜ	�‰œ
¤OÐ4Ó	5ñ $Ù˜=¨#Ó.ð 	$°"Ø�M‰M˜(Ô#÷	$÷$ð $÷	$ð 	$ú÷$ð $úó$   Á
BÁBÁ0BÂB
	ÂBÂBc                 ó2  — t        t        j                  dt        j                  «      }t        d«      }t        j                  t        t        f«      5   ||d«      5 }|j                  | «       ddd«       ddd«       y# 1 sw Y   ŒxY w# 1 sw Y   yxY w)z»
    Test Zip-Slip using an absolute path.
    Will FAIL on PR #3520 because standard zipfile silently ignores the absolute
    root rather than proactively raising a security alert.
    r=   z/etc/cron.d/evil_cronr.   NrG   rK   s       r   Útest_zip_slip_absolute_pathrR   ƒ   s}   € ô œDŸO™O¨Y¼¿¹ÓH€Mä(Ð)@ÓA€MÜ	�‰œ
¤OÐ4Ó	5ñ $Ù˜=¨#Ó.ð 	$°"Ø�M‰M˜(Ô#÷	$÷$ð $÷	$ð 	$ú÷$ð $úrP   )r/   r:   r0   r'   r<   Úurllib.errorr   r   r   Únltk.downloaderr   r   Úfixturer   r   r   r    r"   r*   r7   rE   rO   rR   © ó    r   ú<module>rX      sl   ðÛ Û 	Û 	Û Û ß ,ã ã Ý &ð €‡�˜Ôñó ðò&òòòò<ò."ò*ò$ó$rW   