|
| 1 | +"""Shared GitHub-authenticated HTTP helpers. |
| 2 | +
|
| 3 | +Used by both ExtensionCatalog and PresetCatalog to attach |
| 4 | +GITHUB_TOKEN / GH_TOKEN credentials to requests targeting |
| 5 | +GitHub-hosted domains, while preventing token leakage to |
| 6 | +third-party hosts on redirects. |
| 7 | +""" |
| 8 | + |
| 9 | +import os |
| 10 | +import urllib.request |
| 11 | +from urllib.parse import urlparse |
| 12 | +from typing import Dict |
| 13 | + |
| 14 | +# GitHub-owned hostnames that should receive the Authorization header. |
| 15 | +# Includes codeload.github.com because GitHub archive URL downloads |
| 16 | +# (e.g. /archive/refs/tags/<tag>.zip) redirect there and require auth |
| 17 | +# for private repositories. |
| 18 | +GITHUB_HOSTS = frozenset({ |
| 19 | + "raw.githubusercontent.com", |
| 20 | + "github.com", |
| 21 | + "api.github.com", |
| 22 | + "codeload.github.com", |
| 23 | +}) |
| 24 | + |
| 25 | + |
| 26 | +def build_github_request(url: str) -> urllib.request.Request: |
| 27 | + """Build a urllib Request, adding a GitHub auth header when available. |
| 28 | +
|
| 29 | + Reads GITHUB_TOKEN or GH_TOKEN from the environment and attaches an |
| 30 | + ``Authorization: Bearer <value>`` header when the target hostname is one |
| 31 | + of the known GitHub-owned domains. Non-GitHub URLs are returned as plain |
| 32 | + requests so credentials are never leaked to third-party hosts. |
| 33 | + """ |
| 34 | + headers: Dict[str, str] = {} |
| 35 | + github_token = (os.environ.get("GITHUB_TOKEN") or "").strip() |
| 36 | + gh_token = (os.environ.get("GH_TOKEN") or "").strip() |
| 37 | + token = github_token or gh_token or None |
| 38 | + hostname = (urlparse(url).hostname or "").lower() |
| 39 | + if token and hostname in GITHUB_HOSTS: |
| 40 | + headers["Authorization"] = f"Bearer {token}" |
| 41 | + return urllib.request.Request(url, headers=headers) |
| 42 | + |
| 43 | + |
| 44 | +class _StripAuthOnRedirect(urllib.request.HTTPRedirectHandler): |
| 45 | + """Redirect handler that drops the Authorization header when leaving GitHub. |
| 46 | +
|
| 47 | + Prevents token leakage to CDNs or other third-party hosts that GitHub |
| 48 | + may redirect to (e.g. S3 for release asset downloads, objects.githubusercontent.com). |
| 49 | + Auth is preserved as long as the redirect target remains within GITHUB_HOSTS. |
| 50 | + """ |
| 51 | + |
| 52 | + def redirect_request(self, req, fp, code, msg, headers, newurl): |
| 53 | + original_auth = req.get_header("Authorization") |
| 54 | + new_req = super().redirect_request(req, fp, code, msg, headers, newurl) |
| 55 | + if new_req is not None: |
| 56 | + hostname = (urlparse(newurl).hostname or "").lower() |
| 57 | + if hostname in GITHUB_HOSTS: |
| 58 | + if original_auth: |
| 59 | + new_req.add_unredirected_header("Authorization", original_auth) |
| 60 | + else: |
| 61 | + new_req.headers.pop("Authorization", None) |
| 62 | + new_req.unredirected_hdrs.pop("Authorization", None) |
| 63 | + return new_req |
| 64 | + |
| 65 | + |
| 66 | +def open_github_url(url: str, timeout: int = 10): |
| 67 | + """Open a URL with GitHub auth, stripping the header on cross-host redirects. |
| 68 | +
|
| 69 | + When the request carries an Authorization header, a custom redirect |
| 70 | + handler drops that header if the redirect target is not a GitHub-owned |
| 71 | + domain, preventing token leakage to CDNs or other third-party hosts |
| 72 | + that GitHub may redirect to (e.g. S3 for release asset downloads). |
| 73 | + """ |
| 74 | + req = build_github_request(url) |
| 75 | + |
| 76 | + if not req.get_header("Authorization"): |
| 77 | + return urllib.request.urlopen(req, timeout=timeout) |
| 78 | + |
| 79 | + opener = urllib.request.build_opener(_StripAuthOnRedirect) |
| 80 | + return opener.open(req, timeout=timeout) |
0 commit comments