<commit_before>package org.lantern.proxy;

import io.netty.handler.codec.http.DefaultFullHttpResponse;
import io.netty.handler.codec.http.HttpObject;
import io.netty.handler.codec.http.HttpRequest;
import io.netty.handler.codec.http.HttpResponse;
import io.netty.handler.codec.http.HttpResponseStatus;

import java.net.InetAddress;
import java.net.UnknownHostException;

import org.apache.commons.lang3.StringUtils;
import org.littleshoot.proxy.HttpFiltersAdapter;
import org.littleshoot.proxy.impl.ProxyUtils;
import org.littleshoot.util.NetworkUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

/**
 * Filters used when proxying in Give mode.
 */
public class GiveModeHttpFilters extends HttpFiltersAdapter {

    private static final Logger LOG = LoggerFactory
            .getLogger(GiveModeHttpFilters.class);

    public GiveModeHttpFilters(HttpRequest originalRequest) {
        super(originalRequest);
    }

    /**
     * When running in Give mode, we only allow requests to public addresses.
     */
    @Override
    public HttpResponse requestPre(HttpObject httpObject) {
        String hostAndPort = ProxyUtils.parseHostAndPort(originalRequest
                .getUri());
        final String host;
        if (hostAndPort.contains(":")) {
            host = StringUtils.substringBefore(hostAndPort, ":");
        } else {
            host = hostAndPort;
        }
        try {
            final InetAddress ia = InetAddress.getByName(host);
            if (NetworkUtils.isPublicAddress(ia)) {
                LOG.debug("Allowing request for public address");
            } else {
                // We do this for security reasons -- we don't
                // want to allow proxies to inadvertantly expose
                // internal network services.
                LOG.warn(
                        "Request for non-public resource: {} on address: {}\n full request: {}",
                        originalRequest.getUri(), ia, originalRequest);
                return forbidden();
            }
        } catch (final UnknownHostException uhe) {
            return forbidden();
        }
        return null;
    }

    private HttpResponse forbidden() {
        return new DefaultFullHttpResponse(
                originalRequest.getProtocolVersion(),
                HttpResponseStatus.FORBIDDEN);
    }

}<commit_msg>More logging on non-public resource deny filter<commit_after>package org.lantern.proxy;

import io.netty.handler.codec.http.DefaultFullHttpResponse;
import io.netty.handler.codec.http.HttpObject;
import io.netty.handler.codec.http.HttpRequest;
import io.netty.handler.codec.http.HttpResponse;
import io.netty.handler.codec.http.HttpResponseStatus;

import java.net.InetAddress;
import java.net.UnknownHostException;

import org.apache.commons.lang3.StringUtils;
import org.littleshoot.proxy.HttpFiltersAdapter;
import org.littleshoot.proxy.impl.ProxyUtils;
import org.littleshoot.util.NetworkUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

/**
 * Filters used when proxying in Give mode.
 */
public class GiveModeHttpFilters extends HttpFiltersAdapter {

    private static final Logger LOG = LoggerFactory
            .getLogger(GiveModeHttpFilters.class);

    public GiveModeHttpFilters(HttpRequest originalRequest) {
        super(originalRequest);
    }

    /**
     * When running in Give mode, we only allow requests to public addresses.
     */
    @Override
    public HttpResponse requestPre(HttpObject httpObject) {
        String hostAndPort = ProxyUtils.parseHostAndPort(originalRequest
                .getUri());
        final String host;
        if (hostAndPort.contains(":")) {
            host = StringUtils.substringBefore(hostAndPort, ":");
        } else {
            host = hostAndPort;
        }
        try {
            final InetAddress ia = InetAddress.getByName(host);
            if (NetworkUtils.isPublicAddress(ia)) {
                LOG.debug("Allowing request for public address");
            } else {
                // We do this for security reasons -- we don't
                // want to allow proxies to inadvertantly expose
                // internal network services.
                LOG.warn(
                        "Request for non-public resource: {} on address: {}\n full request headers: {}",
                        originalRequest.getUri(), ia, originalRequest.headers());
                return forbidden();
            }
        } catch (final UnknownHostException uhe) {
            return forbidden();
        }
        return null;
    }

    private HttpResponse forbidden() {
        return new DefaultFullHttpResponse(
                originalRequest.getProtocolVersion(),
                HttpResponseStatus.FORBIDDEN);
    }

}
{'fraction_non_alphanumeric': 0.08949579831932773, 'fraction_numerical': 0.0012605042016806723, 'mean_word_length': 2.410458452722063, 'pattern_counts': {'":': 4, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4040614', 'n_tokens_mistral': 1270, 'n_tokens_neox': 1230, 'n_words': 295}