
    \j                         d dl Z d dlZd dlZd dlZd dlZd dlmZmZ d dlZd dl	Z
d dl	mZ  ej                  d      d        Zd Zd Zd	 Zd
 Zd Zd Zd Zd Zd Zy)    N)	HTTPErrorURLError)
DownloaderT)autousec               #      K   	 ddl } | j                  j                  }d| j                  _        d || j                  _        y# t        $ r d Y yw xY ww)zt
    Dynamically toggle enforcement if pathsec exists.
    If on a branch without pathsec.py, proceed normally.
    r   NT)nltk.pathsecpathsecENFORCEImportError)nltkoriginal_enforces     E/root/env/lib/python3.12/site-packages/nltk/test/unit/test_pathsec.pyenable_enforcementr      sJ     <<//#/ s)   AA A AAAAAc                  \    t        d      } 	 | j                          y # t        $ r Y y w xY w)NzChttps://raw.githubusercontent.com/nltk/nltk_data/gh-pages/index.xmlserver_index_url)r   indexr   dls    r   test_valid_http_urlr   "   s/    	^
B

 s    	++c                      t        d      } t        j                  t        t        f      5  | j                          d d d        y # 1 sw Y   y xY w)Nzfile:///etc/passwdr   r   pytestraises
ValueErrorPermissionErrorr   r   s    r   test_ssrf_invalid_schemer   ,   s<    	%9	:B	
O4	5 

     AAc                      t        d      } t        j                  t        t        f      5  | j                          d d d        y # 1 sw Y   y xY w)Nzhttp://127.0.0.1/adminr   r   r   s    r   test_ssrf_loopback_ipr    2   s<    	%=	>B	
O4	5 

  r   c                      t        d      } t        j                  t        t        f      5  | j                          d d d        y # 1 sw Y   y xY w)Nz(http://169.254.169.254/latest/meta-data/r   r   r   s    r   #test_ssrf_cloud_metadata_link_localr"   8   s<    	%O	PB	
O4	5 

  r   c                     t        d      } 	 | j                          t        j                  d       y# t        t
        f$ r Y yt        $ r"}t        j                  d|        Y d}~yd}~wt        $ rL}t        |j                  t        j                        rnt        j                  d|        Y d}~yY d}~yd}~ww xY w)zNWill FAIL on PR #3520 (on Unix) because string-matching misses the decimal IP.z#http://2852039166/latest/meta-data/r   z2Request succeeded entirely, bypassing all filters.z1Vulnerability bypassed localized string filters: NzUnexpected network failure: )r   r   r   failr   r   r   r   
isinstancereasonsocketgaierror)r   es     r   test_ssrf_ip_obfuscationr*   >   s    	%J	KB<

HI(  MGsKLL <ahh0KK6qc:;; <s'   %4 CCA**C6=B==Cc                  b   	 ddl m}  t        j
                  j                  t        j
                  j                  t        j                        dd      }t        j                  t        t        f      5   | |d       ddd       y# t        $ r t        j                  } Y w xY w# 1 sw Y   yxY w)z
    Test if absolute paths bypass standard relative traversal checks.
    Will FAIL on vulnerable branches because standard builtins.open does not check path boundaries.
    r   )open_nltk_pathsec_testz
secret.txtrN)r   r,   r   builtinsospathjoinabspathsepr   r   r   r   )target_openoutsides     r   test_path_traversal_absoluter7   U   s    
$4 ggll277??26624H,WG	
O4	5 "GS!" "  $mm$" "s   B 3
B%B"!B"%B.c                     t        j                         }t        j                  |d      5 }t        j                  |       }|j                  |d       ddd       |j                  d       |S # 1 sw Y   xY w)z/Helper to create malicious zip files in memory.ws   malicious contentNr   )ioBytesIOzipfileZipFileZipInfowritestrseek)filenamemem_zipzfzinfos       r   create_malicious_ziprE   j   sa    jjlG	#	& 1")
E/01 LLON	1 1s   (A..A7c                 2   t        t        j                  dt        j                        }t        d      }t        j                  t        t        f      5   ||d      5 }|j                  |        ddd       ddd       y# 1 sw Y   xY w# 1 sw Y   yxY w)z
    Test standard ../ Zip-Slip traversal.
    Will FAIL on PR #3520 because standard zipfile silently sanitizes/ignores
    the traversal rather than proactively blocking it and raising an alert.
    r=   z../../../evil.shr.   Ngetattrr   
downloaderr<   r=   rE   r   r   r   r   
extractalltmp_pathTargetZipFilemalicious_ziprC   s       r   test_zip_slip_traversalrO   t   s}     DOOYHM();<M	
O4	5 $=#. 	$"MM(#	$$ $	$ 	$$ $$   
BB0BB
	BBc                 2   t        t        j                  dt        j                        }t        d      }t        j                  t        t        f      5   ||d      5 }|j                  |        ddd       ddd       y# 1 sw Y   xY w# 1 sw Y   yxY w)z
    Test Zip-Slip using an absolute path.
    Will FAIL on PR #3520 because standard zipfile silently ignores the absolute
    root rather than proactively raising a security alert.
    r=   z/etc/cron.d/evil_cronr.   NrG   rK   s       r   test_zip_slip_absolute_pathrR      s}     DOOYHM()@AM	
O4	5 $=#. 	$"MM(#	$$ $	$ 	$$ $rP   )r/   r:   r0   r'   r<   urllib.errorr   r   r   nltk.downloaderr   r   fixturer   r   r   r    r"   r*   r7   rE   rO   rR        r   <module>rX      sl     	 	   ,   &  &<."*$$rW   