# Path: pagekite/proto/filters.py
# class HttpSecurityFilter(HttpHeaderFilter):
#   """Filter that blocks known-to-be-dangerous requests."""
# 
#   DISABLE = 'trusted'
#   HTTP_DANGER = re.compile('(?ism)^((get|post|put|patch|delete) '
#                            # xampp paths, anything starting with /adm*
#                            '((?:/+(?:xampp/|security/|licenses/|webalizer/|server-(?:status|info)|adm)'
#                            '|[^\n]*/'
#                              # WordPress admin pages
#                              '(?:wp-admin/(?!admin-ajax|css/)|wp-config\.php'
#                              # Hackzor tricks
#                              '|system32/|\.\.|\.ht(?:access|pass)'
#                              # phpMyAdmin and similar tools
#                              '|(?:php|sql)?my(?:sql)?(?:adm|manager)'
#                              # Setup pages for common PHP tools
#                              '|(?:adm[^\n]*|install[^\n]*|setup)\.php)'
#                            ')[^\n]*)'
#                            ' HTTP/\d+\.\d+\s*)$')
#   REJECT = 'PAGEKITE_REJECT_'
# 
#   def filter_header_data_in(self, http_hdr, data, info):
#     danger = self.HTTP_DANGER.search(data)
#     if danger:
#       self.ui.Notify('BLOCKED: %s %s' % (danger.group(2), danger.group(3)),
#                      color=self.ui.RED, prefix='***')
#       self.ui.Notify('See https://pagekite.net/support/security/ for more'
#                      ' details.')
#       return self.REJECT+data
#     else:
#       return data


import six
import socket
import sys
import threading
import time
import pagekite.common as common
import pagekite.logging as logging
from pagekite.compat import *
from pagekite.common import *
from .filters import HttpSecurityFilter
from .selectables import *
from .parsers import *
from .proto import *

  def ConnectBE(self, sid, proto, port, host, rIp, rPort, rTLS, data):
    conn = UserConn.BackEnd(proto, host, sid, self, port,
                            remote_ip=rIp, remote_port=rPort, data=data)

    if self.filters:
      if conn:
        rewritehost = conn.config.get('rewritehost')
        if rewritehost is True:
          rewritehost = conn.backend[BE_BHOST]
      else:
        rewritehost = False

      data = self.FilterIncoming(sid, data, info={
        'proto': proto,
        'port': port,
        'host': host,
        'remote_ip': rIp,
        'remote_port': rPort,
        'using_tls': rTLS,
        'be_host': conn and conn.backend[BE_BHOST],
        'be_port': conn and conn.backend[BE_BPORT],
        'trusted': conn and (conn.security or
                             conn.config.get('insecure', False)),
        'rawheaders': conn and conn.config.get('rawheaders', False),
        'proxyproto': conn and conn.config.get('proxyproto', False),
        'rewritehost': rewritehost
      }, connecting=True)

    if proto in ('http', 'http2', 'http3', 'websocket'):

# Path: pagekite/proto/filters.py
# class HttpSecurityFilter(HttpHeaderFilter):
#   """Filter that blocks known-to-be-dangerous requests."""
# 
#   DISABLE = 'trusted'
#   HTTP_DANGER = re.compile('(?ism)^((get|post|put|patch|delete) '
#                            # xampp paths, anything starting with /adm*
#                            '((?:/+(?:xampp/|security/|licenses/|webalizer/|server-(?:status|info)|adm)'
#                            '|[^\n]*/'
#                              # WordPress admin pages
#                              '(?:wp-admin/(?!admin-ajax|css/)|wp-config\.php'
#                              # Hackzor tricks
#                              '|system32/|\.\.|\.ht(?:access|pass)'
#                              # phpMyAdmin and similar tools
#                              '|(?:php|sql)?my(?:sql)?(?:adm|manager)'
#                              # Setup pages for common PHP tools
#                              '|(?:adm[^\n]*|install[^\n]*|setup)\.php)'
#                            ')[^\n]*)'
#                            ' HTTP/\d+\.\d+\s*)$')
#   REJECT = 'PAGEKITE_REJECT_'
# 
#   def filter_header_data_in(self, http_hdr, data, info):
#     danger = self.HTTP_DANGER.search(data)
#     if danger:
#       self.ui.Notify('BLOCKED: %s %s' % (danger.group(2), danger.group(3)),
#                      color=self.ui.RED, prefix='***')
#       self.ui.Notify('See https://pagekite.net/support/security/ for more'
#                      ' details.')
#       return self.REJECT+data
#     else:
#       return data


# Path: pagekite/proto/conns.py
import six
import socket
import sys
import threading
import time
import pagekite.common as common
import pagekite.logging as logging
from pagekite.compat import *
from pagekite.common import *
from .filters import HttpSecurityFilter
from .selectables import *
from .parsers import *
from .proto import *


  def ConnectBE(self, sid, proto, port, host, rIp, rPort, rTLS, data):
    conn = UserConn.BackEnd(proto, host, sid, self, port,
                            remote_ip=rIp, remote_port=rPort, data=data)

    if self.filters:
      if conn:
        rewritehost = conn.config.get('rewritehost')
        if rewritehost is True:
          rewritehost = conn.backend[BE_BHOST]
      else:
        rewritehost = False

      data = self.FilterIncoming(sid, data, info={
        'proto': proto,
        'port': port,
        'host': host,
        'remote_ip': rIp,
        'remote_port': rPort,
        'using_tls': rTLS,
        'be_host': conn and conn.backend[BE_BHOST],
        'be_port': conn and conn.backend[BE_BPORT],
        'trusted': conn and (conn.security or
                             conn.config.get('insecure', False)),
        'rawheaders': conn and conn.config.get('rawheaders', False),
        'proxyproto': conn and conn.config.get('proxyproto', False),
        'rewritehost': rewritehost
      }, connecting=True)

    if proto in ('http', 'http2', 'http3', 'websocket'):

      if conn and data.startswith(HttpSecurityFilter.REJECT):