Fixed:

[fba.git] / fba / csrf.py

diff --git a/fba/csrf.py b/fba/csrf.py
index 859d5cbe338503b27ce93c07d34f86272bf3befc..f529af35017c469cb860e20ed0308cb2a01edf78 100644 (file)
--- a/fba/csrf.py
+++ b/fba/csrf.py
@@ -14,45 +14,45 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
+import logging
+
 import bs4
 import reqto
-import validators
-
-from fba import config
-from fba import network
+import requests
 
+from fba.helpers import config
 from fba.helpers import cookies
+from fba.helpers import domain as domain_helper
+
+from fba.http import network
+
+from fba.models import instances
+
+logging.basicConfig(level=logging.INFO)
+logger = logging.getLogger(__name__)
 
 def determine(domain: str, headers: dict) -> dict:
-    # DEBUG: print(f"DEBUG: domain='{domain}',headers()={len(headers)} - CALLED!")
-    if not isinstance(domain, str):
-        raise ValueError(f"Parameter domain[]='{type(domain)}' is not 'str'")
-    elif domain == "":
-        raise ValueError("Parameter 'domain' is empty")
-    elif not validators.domain(domain.split("/")[0]):
-        raise ValueError(f"domain='{domain}' is not a valid domain")
-    elif domain.endswith(".arpa"):
-        raise ValueError(f"domain='{domain}' is a domain for reversed IP addresses, please don't crawl them!")
-    elif domain.endswith(".tld"):
-        raise ValueError(f"domain='{domain}' is a fake domain, please don't crawl them!")
-    elif not isinstance(headers, dict):
-        raise ValueError(f"Parameter headers[]='{type(headers)}' is not 'dict'")
+    logger.debug("domain='%s',headers()=%d - CALLED!", domain, len(headers))
+    domain_helper.raise_on(domain)
+
+    if not isinstance(headers, dict):
+        raise ValueError(f"Parameter headers[]='{type(headers)}' is not of type 'dict'")
 
     # Default headers with no CSRF
     reqheaders = headers
 
     # Fetch / to check for meta tag indicating csrf
-    # DEBUG: print(f"DEBUG: Fetching / from domain='{domain}' for CSRF check ...")
+    logger.debug("Fetching / from domain='%s' for CSRF check ...", domain)
     response = reqto.get(
         f"https://{domain}/",
         headers=network.web_headers,
         timeout=(config.get("connection_timeout"), config.get("read_timeout"))
     )
 
-    # DEBUG: print(f"DEBUG: response.ok='{response.ok}',response.status_code={response.status_code},response.text()={len(response.text)}")
-    if response.ok and response.status_code < 300 and response.text.find("<html") > 0:
+    logger.debug("response.ok='%s',response.status_code=%d,response.text()=%d", response.ok, response.status_code, len(response.text))
+    if response.ok and response.status_code < 300 and response.text.strip() != "" and response.text.find("<html") > 0 and domain_helper.is_in_url(domain, response.url):
         # Save cookies
-        # DEBUG: print(f"DEBUG: Parsing response.text()={len(response.text)} Bytes ...")
+        logger.debug("Parsing response.text()=%d Bytes ...", len(response.text))
         cookies.store(domain, response.cookies.get_dict())
 
         # Parse text
@@ -60,13 +60,18 @@ def determine(domain: str, headers: dict) -> dict:
             response.text,
             "html.parser"
         )
-        # DEBUG: print(f"DEBUG: meta[]='{type(meta)}'")
+        logger.debug("meta[]='%s'", type(meta))
         tag = meta.find("meta", attrs={"name": "csrf-token"})
 
-        # DEBUG: print(f"DEBUG: tag={tag}")
+        logger.debug("tag[%s]='%s'", type(tag), tag)
         if tag is not None:
-            # DEBUG: print(f"DEBUG: Adding CSRF token='{tag['content']}' for domain='{domain}'")
+            logger.debug("Adding CSRF token='%s' for domain='%s'", tag["content"], domain)
             reqheaders["X-CSRF-Token"] = tag["content"]
+    elif not domain_helper.is_in_url(domain, response.url):
+        logger.warning("domain='%s' doesn't match with response.url='%s', maybe redirect to other domain?", domain, response.url)
+        message = f"Redirect from domain='{domain}' to response.url='{response.url}'"
+        instances.set_last_error(domain, message)
+        raise requests.exceptions.TooManyRedirects(message)
 
-    # DEBUG: print(f"DEBUG: reqheaders()={len(reqheaders)} - EXIT!")
+    logger.debug("reqheaders()=%d - EXIT!", len(reqheaders))
     return reqheaders